Spring Security 6 & JWT Authentication · Lezione

Pratiche per l'archiviazione sicura dei token

Comprenda le best practice per archiviare JWT e refresh token lato client, così da prevenire gli attacchi più comuni.

Pratiche per l'archiviazione sicura dei token è una lezione Spring Security 6 & JWT Authentication gratuita su CoddyKit. Questa è la lezione 3 di 4. Puoi leggere la lezione completa qui gratuitamente — poi esercitati direttamente nel browser con un editor di codice integrato e un tutor IA disponibile 24/7. Fa parte del percorso di apprendimento Spring Security 6 & JWT Authentication, e i tuoi progressi si sincronizzano tra il web e l'app CoddyKit. Il corso Spring Security 6 & JWT Authentication include 4 lezioni in totale.

Parti di questa lezione non sono ancora state tradotte e vengono mostrate in inglese.

Why Secure Token Storage Matters

When building secure applications with JWTs, where you store these tokens on the client-side is crucial. Improper storage can expose your users to various security risks.

This lesson explores the best practices for handling JWTs and refresh tokens in client environments like web browsers, ensuring your application remains robust against common attacks.

Client-Side Storage Options

Web browsers offer several ways to store data, each with different security implications for sensitive tokens:

LocalStorage: Stores data persistently across browser sessions.
SessionStorage: Stores data only for the duration of the browser session.
Cookies: Small pieces of data sent by the server and stored by the browser, sent back with subsequent requests.

Choosing the right option is key to token security.

LocalStorage & SessionStorage Risks

While convenient, LocalStorage and SessionStorage are generally not recommended for storing sensitive JWTs or refresh tokens.

They are vulnerable to Cross-Site Scripting (XSS) attacks. If a malicious script is injected into your page, it can easily access and steal any tokens stored here.

XSS: The Token Thief

Cross-Site Scripting (XSS) is a common web security vulnerability. It allows attackers to inject malicious client-side scripts into web pages viewed by other users.

These scripts can then:

Access and steal data from LocalStorage or SessionStorage.
Perform actions on behalf of the user.
Even hijack user sessions.

This is why tokens in these storages are at high risk.

Introducing HTTP-Only Cookies

For better protection against XSS, HTTP-Only cookies are a strong choice, especially for refresh tokens. An HTTP-Only cookie cannot be accessed by client-side JavaScript.

This means even if an XSS attack occurs, the malicious script cannot read or steal the cookie's content, significantly reducing the risk of token compromise.

Essential Cookie Security Flags

Beyond HTTP-Only, two other flags are critical for cookie security:

Secure: Ensures the cookie is only sent over HTTPS connections. Never use sensitive cookies without this flag in production.
SameSite: Prevents the browser from sending the cookie with cross-site requests, providing robust protection against Cross-Site Request Forgery (CSRF) attacks.

Always use Secure and a suitable SameSite policy (e.g., Lax or Strict).

Setting a Secure Cookie in Spring

Here's how a Spring Boot backend can set an HTTP-Only, Secure, and SameSite cookie. This cookie would typically hold a refresh token.

The browser automatically handles sending this cookie with subsequent requests to your domain, while JavaScript cannot access it.

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class CookieController {

    @GetMapping("/set-secure-cookie")
    public String setSecureCookie(HttpServletResponse response) {
        Cookie refreshTokenCookie = new Cookie("refreshToken", "your_long_refresh_token");
        refreshTokenCookie.setHttpOnly(true); // JS cannot access
        refreshTokenCookie.setSecure(true);   // Only over HTTPS
        refreshTokenCookie.setMaxAge(7 * 24 * 60 * 60); // 7 days
        refreshTokenCookie.setPath("/");
        // Set SameSite to Lax or Strict for CSRF protection
        // Note: For Spring, SameSite often set via application properties
        // or a custom filter for older Servlet versions.
        // With modern Servlet API (e.g., Servlet 4+), can be set directly:
        // refreshTokenCookie.setAttribute("SameSite", "Lax");

        response.addCookie(refreshTokenCookie);
        return "Secure cookie set!";
    }

    public static void main(String[] args) {
        // This is a conceptual example for a Spring Controller.
        // A full Spring Boot app would run this via SpringApplication.run().
        // The main method here is just for completeness as per guidelines,
        // but this code needs a Spring context to fully execute.
        System.out.println("To run, integrate into a Spring Boot application.");
    }
}

Access Token Storage: In-Memory

Access tokens are typically short-lived. The most secure place for an access token on the client-side is often in-memory (e.g., a JavaScript variable).

This means the token is not written to persistent storage and is lost when the browser tab is closed or the page is refreshed. It minimizes exposure, as an XSS attack would only be able to steal the token while the user is actively on the compromised page.

The Combined Secure Strategy

A robust strategy combines the best of both worlds:

Access Token: Store in a JavaScript variable (in-memory). Send it in the Authorization header for API requests. It's short-lived.
Refresh Token: Store in an HTTP-Only, Secure, SameSite cookie. This token is used to obtain new access tokens when the current one expires. It's longer-lived and highly protected.

This approach balances usability with strong security against XSS and CSRF.

Check Your Knowledge

Which of the following are considered best practices for securely storing JWTs and refresh tokens on the client-side?

Recap: Secure Storage Principles

You've learned critical strategies for secure client-side token storage:

Avoid LocalStorage/SessionStorage for sensitive tokens due to XSS risks.
Use HTTP-Only, Secure, SameSite cookies for refresh tokens to protect against XSS and CSRF.
Keep access tokens in-memory (JavaScript variables) as they are short-lived.

By following these practices, you significantly enhance the security posture of your JWT-based authentication system.

Domande Frequenti

La lezione «Pratiche per l'archiviazione sicura dei token» è gratuita?

Sì — il testo completo di «Pratiche per l'archiviazione sicura dei token» è gratuito qui sul web. Per esercitarvi in modo interattivo (un editor di codice integrato e un tutor IA 24/7) e sbloccare il resto del corso Spring Security 6 & JWT Authentication, passa a CoddyKit PRO. Il corso Spring Security 6 & JWT Authentication include 4 lezioni in totale.

Cosa imparerò in «Pratiche per l'archiviazione sicura dei token»?

Comprenda le best practice per archiviare JWT e refresh token lato client, così da prevenire gli attacchi più comuni. Eserciti Spring Security 6 & JWT Authentication con codice pratico che esegui direttamente nel browser, e un tutor IA 24/7 risponde alle tue domande mentre lavori sulla lezione.

Ho bisogno di esperienza per iniziare Spring Security 6 & JWT Authentication?

Non è richiesta alcuna esperienza precedente. Spring Security 6 & JWT Authentication su CoddyKit è strutturato per principianti e studenti avanzati, quindi puoi iniziare da qui o dall'inizio e procedere al tuo ritmo. Questa è la lezione 3 di 4.

Quanto tempo richiede la lezione «Pratiche per l'archiviazione sicura dei token»?

La maggior parte delle lezioni CoddyKit richiede circa 5–10 minuti. Ogni lezione è breve e interattiva, quindi fai progressi costanti e riprendi esattamente da dove hai lasciato su web e app.

Posso scrivere ed eseguire codice in questa lezione Spring Security 6 & JWT Authentication?

Sì. Ogni lezione Spring Security 6 & JWT Authentication include un editor di codice integrato, quindi scrivi ed esegui codice reale direttamente nel tuo browser e ricevi feedback istantaneo dall'IA — nessuna configurazione locale necessaria.

Tutte le lezioni di questo corso

Implementazione dei refresh token
Strategie di revoca dei token JWT
Pratiche per l'archiviazione sicura dei token
Rotazione delle chiavi di firma e gestione delle chiavi

← Torna a Spring Security 6 & JWT Authentication