0Pricing
Spring Security 6 & JWT Authentication · レッスン

安全なトークン保存の実践

一般的な攻撃を防ぐため、クライアント側でJWTやリフレッシュトークンを保存する際のベストプラクティスを理解します。

「安全なトークン保存の実践」はCoddyKit上の無料Spring Security 6 & JWT Authenticationレッスンです。 これはレッスン3/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはSpring Security 6 & JWT Authentication学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Why Secure Token Storage Matters

When building secure applications with JWTs, where you store these tokens on the client-side is crucial. Improper storage can expose your users to various security risks.

This lesson explores the best practices for handling JWTs and refresh tokens in client environments like web browsers, ensuring your application remains robust against common attacks.

Client-Side Storage Options

Web browsers offer several ways to store data, each with different security implications for sensitive tokens:

  • LocalStorage: Stores data persistently across browser sessions.
  • SessionStorage: Stores data only for the duration of the browser session.
  • Cookies: Small pieces of data sent by the server and stored by the browser, sent back with subsequent requests.

Choosing the right option is key to token security.

LocalStorage & SessionStorage Risks

While convenient, LocalStorage and SessionStorage are generally not recommended for storing sensitive JWTs or refresh tokens.

They are vulnerable to Cross-Site Scripting (XSS) attacks. If a malicious script is injected into your page, it can easily access and steal any tokens stored here.

XSS: The Token Thief

Cross-Site Scripting (XSS) is a common web security vulnerability. It allows attackers to inject malicious client-side scripts into web pages viewed by other users.

These scripts can then:

  • Access and steal data from LocalStorage or SessionStorage.
  • Perform actions on behalf of the user.
  • Even hijack user sessions.

This is why tokens in these storages are at high risk.

Introducing HTTP-Only Cookies

For better protection against XSS, HTTP-Only cookies are a strong choice, especially for refresh tokens. An HTTP-Only cookie cannot be accessed by client-side JavaScript.

This means even if an XSS attack occurs, the malicious script cannot read or steal the cookie's content, significantly reducing the risk of token compromise.

Essential Cookie Security Flags

Beyond HTTP-Only, two other flags are critical for cookie security:

  • Secure: Ensures the cookie is only sent over HTTPS connections. Never use sensitive cookies without this flag in production.
  • SameSite: Prevents the browser from sending the cookie with cross-site requests, providing robust protection against Cross-Site Request Forgery (CSRF) attacks.

Always use Secure and a suitable SameSite policy (e.g., Lax or Strict).

Setting a Secure Cookie in Spring

Here's how a Spring Boot backend can set an HTTP-Only, Secure, and SameSite cookie. This cookie would typically hold a refresh token.

The browser automatically handles sending this cookie with subsequent requests to your domain, while JavaScript cannot access it.

import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class CookieController {

    @GetMapping("/set-secure-cookie")
    public String setSecureCookie(HttpServletResponse response) {
        Cookie refreshTokenCookie = new Cookie("refreshToken", "your_long_refresh_token");
        refreshTokenCookie.setHttpOnly(true); // JS cannot access
        refreshTokenCookie.setSecure(true);   // Only over HTTPS
        refreshTokenCookie.setMaxAge(7 * 24 * 60 * 60); // 7 days
        refreshTokenCookie.setPath("/");
        // Set SameSite to Lax or Strict for CSRF protection
        // Note: For Spring, SameSite often set via application properties
        // or a custom filter for older Servlet versions.
        // With modern Servlet API (e.g., Servlet 4+), can be set directly:
        // refreshTokenCookie.setAttribute("SameSite", "Lax");

        response.addCookie(refreshTokenCookie);
        return "Secure cookie set!";
    }

    public static void main(String[] args) {
        // This is a conceptual example for a Spring Controller.
        // A full Spring Boot app would run this via SpringApplication.run().
        // The main method here is just for completeness as per guidelines,
        // but this code needs a Spring context to fully execute.
        System.out.println("To run, integrate into a Spring Boot application.");
    }
}

Access Token Storage: In-Memory

Access tokens are typically short-lived. The most secure place for an access token on the client-side is often in-memory (e.g., a JavaScript variable).

This means the token is not written to persistent storage and is lost when the browser tab is closed or the page is refreshed. It minimizes exposure, as an XSS attack would only be able to steal the token while the user is actively on the compromised page.

The Combined Secure Strategy

A robust strategy combines the best of both worlds:

  • Access Token: Store in a JavaScript variable (in-memory). Send it in the Authorization header for API requests. It's short-lived.
  • Refresh Token: Store in an HTTP-Only, Secure, SameSite cookie. This token is used to obtain new access tokens when the current one expires. It's longer-lived and highly protected.

This approach balances usability with strong security against XSS and CSRF.

Check Your Knowledge

Which of the following are considered best practices for securely storing JWTs and refresh tokens on the client-side?

Recap: Secure Storage Principles

You've learned critical strategies for secure client-side token storage:

  • Avoid LocalStorage/SessionStorage for sensitive tokens due to XSS risks.
  • Use HTTP-Only, Secure, SameSite cookies for refresh tokens to protect against XSS and CSRF.
  • Keep access tokens in-memory (JavaScript variables) as they are short-lived.

By following these practices, you significantly enhance the security posture of your JWT-based authentication system.

よくある質問

「安全なトークン保存の実践」レッスンは無料ですか？

はい。「安全なトークン保存の実践」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Spring Security 6 & JWT Authenticationコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

「安全なトークン保存の実践」で何を学びますか？

一般的な攻撃を防ぐため、クライアント側でJWTやリフレッシュトークンを保存する際のベストプラクティスを理解します。 ブラウザで直接実行するハンズオンコードでSpring Security 6 & JWT Authenticationを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Spring Security 6 & JWT Authenticationを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのSpring Security 6 & JWT Authenticationは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン3/4です。

「安全なトークン保存の実践」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このSpring Security 6 & JWT Authenticationレッスンでコードを書いて実行できますか？

はい。すべてのSpring Security 6 & JWT Authenticationレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

  1. リフレッシュトークンの実装
  2. JWTトークン失効戦略
  3. 安全なトークン保存の実践
  4. 署名キーのローテーションとキー管理
← Spring Security 6 & JWT Authenticationに戻る