Security & Best Practices

Token Security

DO:

• ✅ Store tokens securely (encrypted database, secure key management)
• ✅ Use HTTPS for all API requests
• ✅ Implement token refresh before expiration
• ✅ Revoke tokens when no longer needed

DON'T:

• ❌ Store tokens in localStorage (vulnerable to XSS)
• ❌ Expose tokens in client-side code
• ❌ Commit tokens to version control
• ❌ Log tokens in application logs

OAuth Security

State Parameter:

Always use the state parameter to prevent CSRF attacks:

// Generate random state
const state = crypto.randomBytes(32).toString('hex');

// Store in session
session.oauthState = state;

// Include in authorization URL
const authUrl = `https://awrag.io/api/oauth/authorize?client_id=${clientId}&redirect_uri=${redirectUri}&state=${state}`;

// Verify on callback
if (req.query.state !== session.oauthState) {
  throw new Error('CSRF attack detected');
}

PKCE (Proof Key for Code Exchange): Coming soon for enhanced security in public clients.