Hide Tokens from client side "Front-end"

assa aff

5y915

I have an ASP .net core API that has some tokens like JWT, refresh tokens, ..etc

I want somehow that hide these tokens from frontend like angular for security issues

Is there a way to do this

5 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rijwan Ansari5y ago
Accepted answer
I don't think that you can hide the token as you have to pass it in api calls. However, you can secure access by implementing CORS. So, you can restrict access of api with CORS.

https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0
+2
Rijwan Ansari5y ago
Check these article for BFF. This is used mostly for microservice architecture.

https://nordicapis.com/building-a-backend-for-frontend-shim-for-your-microservices/.
https://samnewman.io/patterns/architectural/bff/
+1
assa aff5y ago
I heard from some that it's a way to do this
with BFF "backend for frontend"
so any idea about how to implement this BFF for web API
+1
Kiran Mohanty5y ago
Instead of storing in local storage or cache, you can store the token in a static property of client side service . But still user can see token in networks tab. For that you need to define custom logic to avoid pressing F12 or open developers tool.
+1
Madan Shekar5y ago
see any how once user login you will recevied the token from the server and further operation you will keep it in local storage or cookie.

Now the question is anyone can read the value from the cookie or local storage.

solution is before storing in local storage or cookie encrypt the token.
+1