1337badger

6 ms·

1. 1.▲
   by 1337badger 12y ago

   I am referring to the application you are writing
2. 2.▲
   by 1337badger 12y ago

   It really depends, it will purge on browser close yes but it still allows access that make not have been intended by your application for use by others also the refresh token may also be stored. The danger is in someone getting this token f
3. 3.▲
   by 1337badger 12y ago

   Usually the token kept in memory is one distributed by the application and is not that which the services send back. This allows greater restriction on actions and make it far easier to revoke effectively
4. 4.▲
   by 1337badger 12y ago

   From what I gather you are leaving the api_tokens for the services in local memory. This means that the user or anyone else that can get there hands on the token can act on the service providers api masquerading as your application.
5. 5.▲
   by 1337badger 12y ago

   This is a terrible idea that is full of security holes! If you can call having paper-thin pseudo security a hole.