Im working on a small Custom Oauth2 Authorization Server. I want to send the Access Token in a http only Cookie to the client. According to 5.1 of the RFC6749 the token has to be in the entity-body of the HTTP Response in an "application/json" media type. Example

 HTTP/1.1 200 OK
 Content-Type: application/json;charset=UTF-8
 Cache-Control: no-store
 Pragma: no-cache


My Problem is there stand's nowhere how to do this in a cookie? If i store all those entries in a cookie then its not in the entity-body of the HTTP-Response as far as im understanding it. What part am i missing, how does the client recognize the access token correctly if its in a cookie? Im using cookies, because i want to prevent javascript access to the token.


You don't want to store access token in a cookie. Depending on the application, you want:

  • typical web application: store the tokens in your backend (database...)
  • native mobile application: store the refresh token in the Keychain / Keystore, and the access tokens in-memory
  • SPA (Single Page Application): store the access token in the localStorage or in the sessionStorage (beware of new risks involved)

And then, when requesting APIs, you insert the access token in the request, preferably in the Authorization header as specified in RFC6750. Example:

GET /api/somedata HTTP/1.1
Host: example.com
Authorization: Bearer NLdtYEY8Y4Q09kKBUnsYy9mExGQnBy
| improve this answer | |
  • For the first use case(typical web application) you mean with backend the backend of the client? Not of the authorization server backend? And when requesting api's i (as the client) fetch the token from the clientdatabase. Just that im understandig it correctly – member2 Oct 6 '19 at 18:47
  • In traditional web applications you don't have a client, your server just displays HTML pages. If you have a client, then it's either a javascript application or a mobile application I guess. – Tangui Oct 7 '19 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.