News for hackers. Stuff that matters.
Re:What Have We Forgotten? by mariusor on Thursday January 30, 2025 @11:06AM (#42879043)
Yes, but I think there are plenty of OAuth2 libraries/clients implemented in ts/js to be used directly from a web application. A JavaScript client running in a web-page still presents itself to the OAuth2 server as the regular "User-Agent" that's used for the web/HTML parts of the interaction unless the requests being done are enhanced with a custom header.

For these clients saving the tokens in the local browser storage is the more elegant option in my opinion, to saving them in a cookie and thus polluting the rest of the browser's requests to that same host.

There are no comments on this comment yet.