0

I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary settings).

But recently I've been working a lot on its security. The last piece I'm trying to sort out is removing everything from the localStorage (specially user info and the JWT). I have contemplated cyphering the info using crypto-js (with AES256), but anyway the key will be on the client at some point. Also I contemplated obfuscating the data using atob() btoa() methods but that's even easier to sort out.

The things I'm exploring right now are:

  • Having everything on a document based database such as DynamoDB, but in that way all user's data will be there anyway, in case everything access it
  • Using a singleton that holds all that data, with the disadvantage that it won't be persistent

What would you recommend? Thanks in advance.

Improve this question
2
  • 5
    What is your threat model? That is, which scenarios are you trying to defend against?
    – l0b0
    Jul 30, 2020 at 3:05
  • User info an JWT tokens are related to the user, why would you try to encrypt it on the client side? as you already mentions, they client needs the key anyway.
    – Frederik Banke
    Jul 30, 2020 at 11:09

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.