--- title: "What are the best practices for securely storing bearer tokens on the client side or server side?" description: "What are the best practices for securely storing bearer tokens on the client side or server side?" author: "Revati S Misra" published: 2023-11-07 updated: 2023-11-10 canonical: https://www.mindstick.com/forum/160434/what-are-the-best-practices-for-securely-storing-bearer-tokens-on-the-client-side-or-server-side category: "bearer token" tags: ["security", "bearer token"] reading_time: 3 minutes --- # What are the best practices for securely storing bearer tokens on the client side or server side? What are the [best practices](https://www.mindstick.com/articles/337564/building-a-microservices-architecture-with-laravel-best-practices) for securely storing bearer [tokens on the client](https://www.mindstick.com/forum/160418/what-are-the-best-practices-for-securely-storing-bearer-tokens-on-the-client-side) side or [server side](https://www.mindstick.com/forum/318/how-to-call-javascript-fuction-in-server-side)? ## Replies ### Reply by Aryan Kumar Securing [bearer tokens](https://www.mindstick.com/forum/160432/integrating-mfa-with-bearer-tokens), whether stored on the [client](https://www.mindstick.com/articles/23198/3-steps-to-ensure-that-your-client-portal-is-impeccable) side or [server](https://www.mindstick.com/articles/43769/what-is-serverless-architecture-is-it-worth-switching-over) side, is crucial for maintaining the integrity of authentication and authorization processes. Here are some best [practices](https://answers.mindstick.com/blog/260/database-design-rules-and-regulations-best-practices) for securely storing bearer tokens: ### On the Client Side: ## Use Secure Storage Mechanisms: - Employ secure storage mechanisms provided by the platform. For web applications, use HTTP cookies with the **Secure** flag and **HttpOnly** flag to ensure transmission over secure channels and prevent client-side access via JavaScript. ## LocalStorage and SessionStorage Considerations: - Avoid storing sensitive tokens in **localStorage** due to potential vulnerabilities, such as cross-site scripting (XSS) attacks. Instead, consider using **sessionStorage** or secure HTTP cookies. ## Token Rotation: - Implement token rotation strategies to mitigate the risk of long-lived tokens being compromised. Refresh tokens or short-lived access tokens can be used in combination to achieve this. ## Token Expiry Handling: - Properly handle token expiration on the client side. When a token expires, initiate the token refresh flow if applicable or prompt the user to re-authenticate. ## Cross-Origin Resource Sharing (CORS): - Configure CORS headers on the server to restrict which origins can make requests with the bearer token. This helps prevent unauthorized cross-origin requests. ## Use Secure Connection (HTTPS): - Ensure that your application uses HTTPS to encrypt the communication channel between the client and the server, preventing eavesdropping and man-in-the-middle attacks. ### On the Server Side: ## Secure Storage: - Store bearer tokens securely on the server side. Avoid storing sensitive information, such as access tokens, in configuration files or hardcoding them within the application. ## Token Encryption: - If bearer tokens carry sensitive information, consider encrypting them to add an extra layer of protection, especially when stored on the server. ## Token Revocation: - Implement token revocation mechanisms. If a token is compromised or needs to be invalidated for any reason, there should be a way to revoke it on the server side. ## Secure Token Transmission: - Transmit tokens securely between components within the server infrastructure. Always use secure channels to prevent interception. ## Least Privilege Principle: - Follow the principle of least privilege when assigning scopes to tokens. Tokens should only contain the necessary information and permissions required for the specific use case. ## Use Token Middleware: - When building server-side applications, leverage token middleware provided by frameworks like ASP.NET Core. This ensures proper validation, authentication, and authorization of tokens. ## Audience Validation: - Validate the audience (aud) claim in the token to ensure it was intended for the specific application or resource. ## Monitoring and Logging: - Implement monitoring and logging for token-related activities. Keep track of token usage, including successful and unsuccessful attempts, to detect and respond to security incidents. ## Secure Token Issuing: - Ensure that the token issuing process (e.g., OAuth 2.0 authorization server) follows best practices, including secure storage of client secrets and proper configuration of authorization flows. ## Regularly Rotate Secrets: - Regularly rotate secrets used for token generation, such as client secrets and signing keys, to limit the impact of compromised credentials. By adhering to these best practices, you can enhance the security of bearer tokens whether stored on the client side or server side. Always stay informed about the latest security guidelines and standards to adapt your practices accordingly. --- Original Source: https://www.mindstick.com/forum/160434/what-are-the-best-practices-for-securely-storing-bearer-tokens-on-the-client-side-or-server-side Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.