I'm developing an Ionic 4 based (Angular) web application. It has a lot of logic on it and needs to store session specific data (such as a JWT, selected language, among other preferences and temporary settings).
But recently I've been working a lot on its security. The last piece I'm trying to sort out is removing everything from the localStorage (specially user info and the JWT). I have contemplated cyphering the info using crypto-js (with AES256), but anyway the key will be on the client at some point. Also I contemplated obfuscating the data using atob() btoa() methods but that's even easier to sort out.
The things I'm exploring right now are:
- Having everything on a document based database such as DynamoDB, but in that way all user's data will be there anyway, in case everything access it
- Using a singleton that holds all that data, with the disadvantage that it won't be persistent
What would you recommend? Thanks in advance.