I'm using google oauth2.0 code authorization flow in my app. my app needs to use google api, so client side needs to set access_token as a Authorization header. my app consists of two part. frontend is React built with create-react-app and backend api server is Koa.
Here is the flow
- client get code and send back to server
- server exchange code with access_token
the problem is, I have no idea how can api server send to client safely.
- if server send access_token to post response body, it could be hijacked
- if server send access_token within cookies with httpOnly, react app built with create-react-app couldn't get access_token from cookie because it's CSR.
So I tried to build new jsonwebtoken with access_token and send to client within cookie with no httpOnly options.
I'm struggle into these.
how can server can send back to client some critical information safely?