0Pricing
Spring Security 6 & JWT Authentication · Lección

Prácticas seguras para almacenar tokens

Conozca las prácticas recomendadas para almacenar tokens JWT y tokens de actualización en el cliente y prevenir ataques habituales.

Prácticas seguras para almacenar tokens es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

Why Secure Token Storage Matters

When building secure applications with JWTs, where you store these tokens on the client-side is crucial. Improper storage can expose your users to various security risks.

This lesson explores the best practices for handling JWTs and refresh tokens in client environments like web browsers, ensuring your application remains robust against common attacks.

Client-Side Storage Options

Web browsers offer several ways to store data, each with different security implications for sensitive tokens:

  • LocalStorage: Stores data persistently across browser sessions.
  • SessionStorage: Stores data only for the duration of the browser session.
  • Cookies: Small pieces of data sent by the server and stored by the browser, sent back with subsequent requests.

Choosing the right option is key to token security.

LocalStorage & SessionStorage Risks

While convenient, LocalStorage and SessionStorage are generally not recommended for storing sensitive JWTs or refresh tokens.

They are vulnerable to Cross-Site Scripting (XSS) attacks. If a malicious script is injected into your page, it can easily access and steal any tokens stored here.

XSS: The Token Thief

Cross-Site Scripting (XSS) is a common web security vulnerability. It allows attackers to inject malicious client-side scripts into web pages viewed by other users.

These scripts can then:

  • Access and steal data from LocalStorage or SessionStorage.
  • Perform actions on behalf of the user.
  • Even hijack user sessions.

This is why tokens in these storages are at high risk.

Introducing HTTP-Only Cookies

For better protection against XSS, HTTP-Only cookies are a strong choice, especially for refresh tokens. An HTTP-Only cookie cannot be accessed by client-side JavaScript.

This means even if an XSS attack occurs, the malicious script cannot read or steal the cookie's content, significantly reducing the risk of token compromise.

Essential Cookie Security Flags

Beyond HTTP-Only, two other flags are critical for cookie security:

  • Secure: Ensures the cookie is only sent over HTTPS connections. Never use sensitive cookies without this flag in production.
  • SameSite: Prevents the browser from sending the cookie with cross-site requests, providing robust protection against Cross-Site Request Forgery (CSRF) attacks.

Always use Secure and a suitable SameSite policy (e.g., Lax or Strict).

Setting a Secure Cookie in Spring

Here's how a Spring Boot backend can set an HTTP-Only, Secure, and SameSite cookie. This cookie would typically hold a refresh token.

The browser automatically handles sending this cookie with subsequent requests to your domain, while JavaScript cannot access it.

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class CookieController {

    @GetMapping("/set-secure-cookie")
    public String setSecureCookie(HttpServletResponse response) {
        Cookie refreshTokenCookie = new Cookie("refreshToken", "your_long_refresh_token");
        refreshTokenCookie.setHttpOnly(true); // JS cannot access
        refreshTokenCookie.setSecure(true);   // Only over HTTPS
        refreshTokenCookie.setMaxAge(7 * 24 * 60 * 60); // 7 days
        refreshTokenCookie.setPath("/");
        // Set SameSite to Lax or Strict for CSRF protection
        // Note: For Spring, SameSite often set via application properties
        // or a custom filter for older Servlet versions.
        // With modern Servlet API (e.g., Servlet 4+), can be set directly:
        // refreshTokenCookie.setAttribute("SameSite", "Lax");

        response.addCookie(refreshTokenCookie);
        return "Secure cookie set!";
    }

    public static void main(String[] args) {
        // This is a conceptual example for a Spring Controller.
        // A full Spring Boot app would run this via SpringApplication.run().
        // The main method here is just for completeness as per guidelines,
        // but this code needs a Spring context to fully execute.
        System.out.println("To run, integrate into a Spring Boot application.");
    }
}

Access Token Storage: In-Memory

Access tokens are typically short-lived. The most secure place for an access token on the client-side is often in-memory (e.g., a JavaScript variable).

This means the token is not written to persistent storage and is lost when the browser tab is closed or the page is refreshed. It minimizes exposure, as an XSS attack would only be able to steal the token while the user is actively on the compromised page.

The Combined Secure Strategy

A robust strategy combines the best of both worlds:

  • Access Token: Store in a JavaScript variable (in-memory). Send it in the Authorization header for API requests. It's short-lived.
  • Refresh Token: Store in an HTTP-Only, Secure, SameSite cookie. This token is used to obtain new access tokens when the current one expires. It's longer-lived and highly protected.

This approach balances usability with strong security against XSS and CSRF.

Check Your Knowledge

Which of the following are considered best practices for securely storing JWTs and refresh tokens on the client-side?

Recap: Secure Storage Principles

You've learned critical strategies for secure client-side token storage:

  • Avoid LocalStorage/SessionStorage for sensitive tokens due to XSS risks.
  • Use HTTP-Only, Secure, SameSite cookies for refresh tokens to protect against XSS and CSRF.
  • Keep access tokens in-memory (JavaScript variables) as they are short-lived.

By following these practices, you significantly enhance the security posture of your JWT-based authentication system.

Preguntas frecuentes

¿La lección «Prácticas seguras para almacenar tokens» es gratis?

Sí — el texto completo de «Prácticas seguras para almacenar tokens» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Prácticas seguras para almacenar tokens»?

Conozca las prácticas recomendadas para almacenar tokens JWT y tokens de actualización en el cliente y prevenir ataques habituales. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.

¿Cuánto tiempo toma la lección «Prácticas seguras para almacenar tokens»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

  1. Implementación de tokens de actualización
  2. Estrategias de revocación de tokens JWT
  3. Prácticas seguras para almacenar tokens
  4. Rotación de claves de firma y gestión de claves
← Volver a Spring Security 6 & JWT Authentication