html - Is storing an OAuth token in cookies bad practice?

Question

Is storing an OAuth 2 token in cookies bad practice? If so, what are alternatives for a web app?

Answer 1

Whether you can store the access_token in cookies depends on following things:

1. Is the access_token stored in cookie encrypted or not (it definitely should be)
2. Access_token is a bearer token so it is not tied to browser flows. Cookies in general are meant for maintaining state in browsers. So if lifecycle of token is same as cookie, go ahead otherwise not. When I say lifecycle, I mean lifespan, etc.
3. Also, please consider this fact too that access token is not identity token
4. Access tokens are completely client side, and servers that generally use cookies to maintain sessions, mostly maintain matching server side session as well.

I hope this helps.