Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third party javascript from a range of external sources but has a CSP in place, though for a sample of third party domains it has to be liberal.
Theres a requirement to make a Cross Origin request from the browser to an api e.g. mydomain.com -> newdomain.com and we want to share this authentication.
One approach suggested is setting an authorisation header containing the auth token on the clientside request. But for this to be accessible in the client it needs to be stored somewhere in the browser such as the DOM where the JS can retrieve this from.
My concern with this approach is its exposing this credential to third party scripts that could be victim of a bad actor.
Understand cookie based approach also has some cons, e.g. csrf
Are there any best practices in this scenario or recommendations?
