We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications.

Using the Angular quickstart, the token is set in the Authorization header (as you can see below). My question may sound dumb, but since Javascript will always be able to access the token: isn't it a huge vulnerability? (in case of XSS)

Would it be better to use a http-only cookie?

Example of request to the API using the Angular quickstart:

- Request URL:

- Request Method:

- Response Headers 
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://my-app.com

- Request Headers 
Authorization: bearer eyJhbGciOiJSUzI1N.............
Origin: https://my-app.com
Referer: https://my-app.com/
User-Agent: Mozilla.............

Link to the angular quickstart: https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-angular2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.