Crawling and auditing the traffic using the Burp Suite, our Angular application was flagged for the following:

OWASP Top 10 Classification - Broken authentication and session management - Sensitive data exposure

I was able to grab the tokens from the url during the login-redirect process, and I looked at them in jwt.io. It seems to me like there really isn't any sensitive information in this token. But more importantly, my questions are:

Is this something that single page applications can avoid? What is the alternative approach if you want to avoid this security concern? Is it really a concern that the token appears in the URL if the token itself is also present in local storage the whole time?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.