Assuming the need for OAuth

Imagine an application that is:

  1. A single page web application hosted on S3
  2. Authenticated using implicit OAuth flow implicit
  3. Have the web application access resources with their JWTs

This exposes the session to the JavaScript and requires hardening of the client to protect the user's session.

I understand that conventionally, the session has been stored in an http-only cookie. Where, what is essentially a proxy server which hosts the client, is responsible for accessing resources using the session stored in a cookie.

While the former approach simplifies development and is more akin to native app development, is it too insecure to be a technique to be considered?

What type/size of project would be an example of an acceptable use case? Twitter? Reddit? Finance Provider? Banking institution?

New contributor
David Alsh is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

David Alsh is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.