CODEWITHSUNDEEP
angularjsdropboxdropbox-apijwtjson-web-token
Viacheslav Yankov
Viacheslav Yankov

Reputation: 1008

Dropbox. Storing access tokens in web storage

I am developing SPA with AngularJs that will work with Dropbox API. I need to save dropbox access token in web storage or cookies, but I'm not sure that it is safe.

Are there any mechanisms for secure storage of access tokens?

Thanks.

Upvotes: 0

Views: 512

Answers (1)

Reactgular
Reactgular

Reputation: 54821

The token that DropBox gives you when you start an oAuth session can be stored safely in the browser's local storage or cookies. It is a hash token that will only work with your applications API key.

It's your secret application key that should not be stored in the browser. That key is associated with your DropBox API account, and should only be used on the server-end.

The secret key is supposed to be kept secret. I'm sure you'll validate DropBox's terms of use by storing it any browser JavaScript. Secondly, there is no such thing as secure browser-side storage.

https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/

If you want to continue anyway. There are open source encrypto libraries for JavaScript.

https://code.google.com/p/crypto-js/

It's a futile effort, because at the end of it you are just basically replacing one secret key with another secret key. At some point your SPA needs to start decrypting something using a secret key and where is it going to get that from?

Upvotes: -1

Related Questions