Crawling and auditing the traffic using the Burp Suite, our Angular application was flagged for the following:
OWASP Top 10 Classification - Broken authentication and session management - Sensitive data exposure
I was able to grab the tokens from the url during the login-redirect process, and I looked at them in jwt.io. It seems to me like there really isn't any sensitive information in this token. But more importantly, my questions are:
Is this something that single page applications can avoid? What is the alternative approach if you want to avoid this security concern? Is it really a concern that the token appears in the URL if the token itself is also present in local storage the whole time?