I have a question regarding the “correct” use of the “getAccessTokenSilently” function.
As I understand it, I get a token here and it is stored in memory and then read from it when it is needed. I am currently using my own Axios instance, which has an interceptor function and writes the token to the header. But theoretically this token could be intercepted by anyone in the frontend or not? I would therefore like to know what would be the best way to make the whole thing reasonably secure.
Assuming the Axios instance and general coding practices are secure, storing tokens in memory and utilizing HTTPS along with other best practices provide a reasonable level of security.
Thank you very much for your reply @tyf!
But theoretically speaking, wouldn’t it be possible for someone to just add a breakpoint with the browser DevTools and then just execute the getAccessTokenSilently function?
This maybe Is a stupid question, but I just want to make sure.