I've developed a client application which talks over a REST API to a server. The way the application works is to send the username/pwd pair in the initial login to the server and then respond with an auth token in the form of a newly generated GUID.
The client uses the GUID to talk to the server for the remainder of the session (forever until the local storage is cleared). The login page requires the ability to stay logged in. To achieve this, I store the GUID token in local storage. If the key is there then it auto-logs into the app.
All of the comms is carried out over SSL so I'm not worried about the security of the data or MITM, but I am concerned about the security of the token stored in local storage.
- Should I encrypt the GUID further? Does this give me anything?
- Is storing the GUID auth token in local storage a big security risk? Worth securing?
- Does storing the token inside a cookie improve matters at all?
I also thought about having the server generate new tokens every new login and reduce the window of attack, but that would then prevent the 'remember me' feature from working.