Closed aaronpk closed 1 year ago
I think it would be good to have such a section to promote such best practices in a concrete way, but I see a problem in having it be too reliant on existing technologies since it can go out of date so quickly. I don't keep up to date with browser developments too much, but it seems like the recommendation has gone from keeping tokens solely in memory (possible with silent renew), to keeping tokens in the storage mechanisms you mentioned, to possibly keeping them in WebWorkers (pending investigation). We may even see this change again if browsers support a secure local storage system, or once the WebID proposal makes it, etc. Because of these, it might make more sense to have the section detail the desired properties that tokens would be stored with, and like you mentioned, the different attack vectors that we know are associated with each. For example:
private
achieve this behaviour?)Note that JS isn't my speciality so take these suggestions with a pinch of salt.
Alright, this is a lot, but I finally put together the start to this section. I'm definitely open to suggestions and corrections. Here's the link to the current draft:
It's kind of a wall of text right now, so probably could use some help breaking it up into different sub-headers.
This now has section headers and is a lot more readable. I also added a new section about sender-constrained tokens as well as a reference to DPoP.