Where should I store the token on the frontend?

[imgyf]

Hey @gonzalo-bulnes, I love your super simple gem for API authentication.

I'm wondering what's the most secure way to store the token on the frontend. Could you advise, please? Thanks.

[swikars1]

localstorage, your can encrypt before storing if u want

[buncis]

@gohyifan check this https://pragmaticstudio.com/tutorials/rails-session-cookies-for-api-authentication

as for localstorage its kinda dangerous because its vulnerable to XSS attack

[gonzalo-bulnes]

@imgyf Indeed, the short answer is that you should probably not store these tokens on the frontend. I've added a note about this in the README.

Thanks for the helpful reference @buncis !