Im working on a small Custom Oauth2 Authorization Server. I want to send the Access Token in a http only Cookie to the client. According to 5.1 of the RFC6749 the token has to be in the entity-body of the HTTP Response in an "application/json" media type. Example

 HTTP/1.1 200 OK
 Content-Type: application/json;charset=UTF-8
 Cache-Control: no-store
 Pragma: no-cache


My Problem is there stand's nowhere how to do this in a cookie? If i store all those entries in a cookie then its not in the entity-body of the HTTP-Response as far as im understanding it. What part am i missing, how does the client recognize the access token correctly if its in a cookie? Im using cookies, because i want to prevent javascript access to the token.

  • you can't really prevent javascript access to the token... whether it's in the header, the body, local storage, or cookie. Javascript is client-side and the client has to retrieve the token to use it.
    – pcalkins
    May 29, 2020 at 23:01

1 Answer 1


You don't want to store access token in a cookie. Depending on the application, you want:

  • typical web application: store the tokens in your backend (database...)
  • native mobile application: store the refresh token in the Keychain / Keystore, and the access tokens in-memory
  • SPA (Single Page Application): store the access token in the localStorage or in the sessionStorage (beware of new risks involved)

And then, when requesting APIs, you insert the access token in the request, preferably in the Authorization header as specified in RFC6750. Example:

GET /api/somedata HTTP/1.1
Host: example.com
Authorization: Bearer NLdtYEY8Y4Q09kKBUnsYy9mExGQnBy
  • For the first use case(typical web application) you mean with backend the backend of the client? Not of the authorization server backend? And when requesting api's i (as the client) fetch the token from the clientdatabase. Just that im understandig it correctly
    – member2
    Oct 6, 2019 at 18:47
  • In traditional web applications you don't have a client, your server just displays HTML pages. If you have a client, then it's either a javascript application or a mobile application I guess.
    – Tangui
    Oct 7, 2019 at 17:52
  • ...the browser is the client in the case of "traditional" web application. The server always has a client. Though it could be another server, like in OAuth authentication...
    – pcalkins
    May 29, 2020 at 22:40
  • Sorry but it doesn't make sense to me
    – Tangui
    May 30, 2020 at 23:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.