Secure Token Storage Practices
Understand the best practices for storing JWTs and refresh tokens on the client-side to prevent common attacks.
Secure Token Storage Practices is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Secure Token Storage Matters
When building secure applications with JWTs, where you store these tokens on the client-side is crucial. Improper storage can expose your users to various security risks.
This lesson explores the best practices for handling JWTs and refresh tokens in client environments like web browsers, ensuring your application remains robust against common attacks.
Client-Side Storage Options
Web browsers offer several ways to store data, each with different security implications for sensitive tokens:
- LocalStorage: Stores data persistently across browser sessions.
- SessionStorage: Stores data only for the duration of the browser session.
- Cookies: Small pieces of data sent by the server and stored by the browser, sent back with subsequent requests.
Choosing the right option is key to token security.
LocalStorage & SessionStorage Risks
While convenient, LocalStorage and SessionStorage are generally not recommended for storing sensitive JWTs or refresh tokens.
They are vulnerable to Cross-Site Scripting (XSS) attacks. If a malicious script is injected into your page, it can easily access and steal any tokens stored here.
XSS: The Token Thief
Cross-Site Scripting (XSS) is a common web security vulnerability. It allows attackers to inject malicious client-side scripts into web pages viewed by other users.
These scripts can then:
- Access and steal data from
LocalStorageorSessionStorage. - Perform actions on behalf of the user.
- Even hijack user sessions.
This is why tokens in these storages are at high risk.
Introducing HTTP-Only Cookies
For better protection against XSS, HTTP-Only cookies are a strong choice, especially for refresh tokens. An HTTP-Only cookie cannot be accessed by client-side JavaScript.
This means even if an XSS attack occurs, the malicious script cannot read or steal the cookie's content, significantly reducing the risk of token compromise.
Essential Cookie Security Flags
Beyond HTTP-Only, two other flags are critical for cookie security:
- Secure: Ensures the cookie is only sent over HTTPS connections. Never use sensitive cookies without this flag in production.
- SameSite: Prevents the browser from sending the cookie with cross-site requests, providing robust protection against Cross-Site Request Forgery (CSRF) attacks.
Always use Secure and a suitable SameSite policy (e.g., Lax or Strict).
Setting a Secure Cookie in Spring
Here's how a Spring Boot backend can set an HTTP-Only, Secure, and SameSite cookie. This cookie would typically hold a refresh token.
The browser automatically handles sending this cookie with subsequent requests to your domain, while JavaScript cannot access it.
import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class CookieController {
@GetMapping("/set-secure-cookie")
public String setSecureCookie(HttpServletResponse response) {
Cookie refreshTokenCookie = new Cookie("refreshToken", "your_long_refresh_token");
refreshTokenCookie.setHttpOnly(true); // JS cannot access
refreshTokenCookie.setSecure(true); // Only over HTTPS
refreshTokenCookie.setMaxAge(7 * 24 * 60 * 60); // 7 days
refreshTokenCookie.setPath("/");
// Set SameSite to Lax or Strict for CSRF protection
// Note: For Spring, SameSite often set via application properties
// or a custom filter for older Servlet versions.
// With modern Servlet API (e.g., Servlet 4+), can be set directly:
// refreshTokenCookie.setAttribute("SameSite", "Lax");
response.addCookie(refreshTokenCookie);
return "Secure cookie set!";
}
public static void main(String[] args) {
// This is a conceptual example for a Spring Controller.
// A full Spring Boot app would run this via SpringApplication.run().
// The main method here is just for completeness as per guidelines,
// but this code needs a Spring context to fully execute.
System.out.println("To run, integrate into a Spring Boot application.");
}
}Access Token Storage: In-Memory
Access tokens are typically short-lived. The most secure place for an access token on the client-side is often in-memory (e.g., a JavaScript variable).
This means the token is not written to persistent storage and is lost when the browser tab is closed or the page is refreshed. It minimizes exposure, as an XSS attack would only be able to steal the token while the user is actively on the compromised page.
The Combined Secure Strategy
A robust strategy combines the best of both worlds:
- Access Token: Store in a JavaScript variable (in-memory). Send it in the
Authorizationheader for API requests. It's short-lived. - Refresh Token: Store in an
HTTP-Only,Secure,SameSitecookie. This token is used to obtain new access tokens when the current one expires. It's longer-lived and highly protected.
This approach balances usability with strong security against XSS and CSRF.
Check Your Knowledge
Which of the following are considered best practices for securely storing JWTs and refresh tokens on the client-side?
Recap: Secure Storage Principles
You've learned critical strategies for secure client-side token storage:
- Avoid LocalStorage/SessionStorage for sensitive tokens due to XSS risks.
- Use HTTP-Only, Secure, SameSite cookies for refresh tokens to protect against XSS and CSRF.
- Keep access tokens in-memory (JavaScript variables) as they are short-lived.
By following these practices, you significantly enhance the security posture of your JWT-based authentication system.
Frequently asked questions
Is the “Secure Token Storage Practices” lesson free?
Yes — the full text of “Secure Token Storage Practices” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.
What will I learn in “Secure Token Storage Practices”?
Understand the best practices for storing JWTs and refresh tokens on the client-side to prevent common attacks. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Spring Security 6 & JWT Authentication?
No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Secure Token Storage Practices” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Spring Security 6 & JWT Authentication lesson?
Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Implementing Refresh Tokens
- JWT Token Revocation Strategies
- Secure Token Storage Practices
- Rotating Signing Keys and Key Management