0

I'm using google oauth2.0 code authorization flow in my app. my app needs to use google api, so client side needs to set access_token as a Authorization header. my app consists of two part. frontend is React built with create-react-app and backend api server is Koa.

Here is the flow

  1. client get code and send back to server
  2. server exchange code with access_token

the problem is, I have no idea how can api server send to client safely.

  1. if server send access_token to post response body, it could be hijacked
  2. if server send access_token within cookies with httpOnly, react app built with create-react-app couldn't get access_token from cookie because it's CSR.

So I tried to build new jsonwebtoken with access_token and send to client within cookie with no httpOnly options.

I'm struggle into these.
how can server can send back to client some critical information safely?

dante
  • 933
  • 4
  • 16
  • 39

1 Answers1

1

This is not related to react. however, the thing is for most deployed apps, you would use ssl, ie, an encrypted connection, ie, the https:// you see in most websites. here is how you can implement it in koa. it is perfectly fine to send accessTokens in headers.

Add SSL to Node.js Koa Server?

Lav Hinsu
  • 104
  • 1
  • 6