Most secure way to pass Laravel passport access_token from Laravel blade to React component











up vote
1
down vote

favorite
1












I'm building chat application with ReactJS and Laravel, we are using Laravel Echo.
API needs an access_token to be authenticated so we need to pass the access_token in the component.



How can do it securely?






reactjs laravel security laravel-echo







share|improve this question


























    up vote
    1
    down vote

    favorite
    1












    I'm building chat application with ReactJS and Laravel, we are using Laravel Echo.
    API needs an access_token to be authenticated so we need to pass the access_token in the component.



    How can do it securely?






    reactjs laravel security laravel-echo







    share|improve this question
























      up vote
      1
      down vote

      favorite
      1









      up vote
      1
      down vote

      favorite
      1






      1





      I'm building chat application with ReactJS and Laravel, we are using Laravel Echo.
      API needs an access_token to be authenticated so we need to pass the access_token in the component.



      How can do it securely?






      reactjs laravel security laravel-echo







      share|improve this question













      I'm building chat application with ReactJS and Laravel, we are using Laravel Echo.
      API needs an access_token to be authenticated so we need to pass the access_token in the component.



      How can do it securely?






      reactjs laravel security laravel-echo




      reactjs laravel security laravel-echo






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 11 hours ago









      frenchqwerty

      134




      134
























          2 Answers
          2






          active

          oldest

          votes

















          up vote
          0
          down vote













          The backend should have all api keys. Assume that anything sent to frontend can and will be copied to use elsewhere.



          I strongly suggest that you use JWT (json web tokens) to handle authentication and make all such api calls on the backend on behalf of the authenticated user. Ideally checking if the user has permissions to do so.






          share|improve this answer




























            up vote
            0
            down vote













            The access_token can be generated by Laravel Passport (LP). Since LP is just an integration into The PHP League's OAuth 2, JSON Web Tokens (JWT) are issued by default. These tokens are pretty safe to be stored on the client side.



            If you check the documentation, you will be able to generate tokens for users without going through the normal OAuth 2 flow.



            Using the browser's LocalStorage, you can then store this token for future use.






            share|improve this answer





















              Your Answer






              StackExchange.ifUsing("editor", function () {
              StackExchange.using("externalEditor", function () {
              StackExchange.using("snippets", function () {
              StackExchange.snippets.init();
              });
              });
              }, "code-snippets");

              StackExchange.ready(function() {
              var channelOptions = {
              tags: "".split(" "),
              id: "1"
              };
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function() {
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled) {
              StackExchange.using("snippets", function() {
              createEditor();
              });
              }
              else {
              createEditor();
              }
              });

              function createEditor() {
              StackExchange.prepareEditor({
              heartbeatType: 'answer',
              convertImagesToLinks: true,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: 10,
              bindNavPrevention: true,
              postfix: "",
              imageUploader: {
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              },
              onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              });


              }
              });














               

              draft saved


              draft discarded


















              StackExchange.ready(
              function () {
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53400434%2fmost-secure-way-to-pass-laravel-passport-access-token-from-laravel-blade-to-reac%23new-answer', 'question_page');
              }
              );

              Post as a guest















              Required, but never shown

























              2 Answers
              2






              active

              oldest

              votes








              2 Answers
              2






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes








              up vote
              0
              down vote













              The backend should have all api keys. Assume that anything sent to frontend can and will be copied to use elsewhere.



              I strongly suggest that you use JWT (json web tokens) to handle authentication and make all such api calls on the backend on behalf of the authenticated user. Ideally checking if the user has permissions to do so.






              share|improve this answer

























                up vote
                0
                down vote













                The backend should have all api keys. Assume that anything sent to frontend can and will be copied to use elsewhere.



                I strongly suggest that you use JWT (json web tokens) to handle authentication and make all such api calls on the backend on behalf of the authenticated user. Ideally checking if the user has permissions to do so.






                share|improve this answer























                  up vote
                  0
                  down vote










                  up vote
                  0
                  down vote









                  The backend should have all api keys. Assume that anything sent to frontend can and will be copied to use elsewhere.



                  I strongly suggest that you use JWT (json web tokens) to handle authentication and make all such api calls on the backend on behalf of the authenticated user. Ideally checking if the user has permissions to do so.






                  share|improve this answer












                  The backend should have all api keys. Assume that anything sent to frontend can and will be copied to use elsewhere.



                  I strongly suggest that you use JWT (json web tokens) to handle authentication and make all such api calls on the backend on behalf of the authenticated user. Ideally checking if the user has permissions to do so.







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered 11 hours ago









                  Sergio Moura

                  4,01511631




                  4,01511631
























                      up vote
                      0
                      down vote













                      The access_token can be generated by Laravel Passport (LP). Since LP is just an integration into The PHP League's OAuth 2, JSON Web Tokens (JWT) are issued by default. These tokens are pretty safe to be stored on the client side.



                      If you check the documentation, you will be able to generate tokens for users without going through the normal OAuth 2 flow.



                      Using the browser's LocalStorage, you can then store this token for future use.






                      share|improve this answer

























                        up vote
                        0
                        down vote













                        The access_token can be generated by Laravel Passport (LP). Since LP is just an integration into The PHP League's OAuth 2, JSON Web Tokens (JWT) are issued by default. These tokens are pretty safe to be stored on the client side.



                        If you check the documentation, you will be able to generate tokens for users without going through the normal OAuth 2 flow.



                        Using the browser's LocalStorage, you can then store this token for future use.






                        share|improve this answer























                          up vote
                          0
                          down vote










                          up vote
                          0
                          down vote









                          The access_token can be generated by Laravel Passport (LP). Since LP is just an integration into The PHP League's OAuth 2, JSON Web Tokens (JWT) are issued by default. These tokens are pretty safe to be stored on the client side.



                          If you check the documentation, you will be able to generate tokens for users without going through the normal OAuth 2 flow.



                          Using the browser's LocalStorage, you can then store this token for future use.






                          share|improve this answer












                          The access_token can be generated by Laravel Passport (LP). Since LP is just an integration into The PHP League's OAuth 2, JSON Web Tokens (JWT) are issued by default. These tokens are pretty safe to be stored on the client side.



                          If you check the documentation, you will be able to generate tokens for users without going through the normal OAuth 2 flow.



                          Using the browser's LocalStorage, you can then store this token for future use.







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered 8 hours ago









                          Caleb Lucas

                          165




                          165






























                               

                              draft saved


                              draft discarded



















































                               


                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function () {
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53400434%2fmost-secure-way-to-pass-laravel-passport-access-token-from-laravel-blade-to-reac%23new-answer', 'question_page');
                              }
                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              -

                              Popular posts from this blog

                              Berounka

                              Image
                              Berounka.mw-parser-output .entete.map{background-image:url("//upload.wikimedia.org/wikipedia/commons/7/7a/Picto_infobox_map.png")} Caractéristiques Longueur 139  km Bassin 8 861  km 2 Bassin collecteur Elbe Débit moyen ? Cours Source Confluence de la Mže et de la Radbuza · Localisation Pilsen · Altitude 305  m · Coordonnées 49° 45′ 13″ N, 13° 23′ 24″ E Confluence Vltava · Localisation Prague · Altitude 187  m · Coordonnées 49° 59′ 43″ N, 14° 24′ 04″ E Géographie Pays traversés   République tchèque modifier   La Berounka est une rivière de la République tchèque. Elle porte le nom de Mže depuis sa source en Allemagne près de la frontière jusqu'à sa confluence avec la Radbuza à Plzeň. Elle continue ensuite sous le nom de Berounka jusqu'à sa confluence avec la Vltava, près de Prague. La rivière est une destination prisée pour les amateurs de canoë, qui appréc...
                              Read more

                              Sphinx de Gizeh

                              Image
                              Pour les articles homonymes, voir Sphinx. Sphinx de Gizeh.mw-parser-output .entete.egypte-antique{background-image:url("//upload.wikimedia.org/wikipedia/commons/c/cc/Picto_infobox_ancient_Egypt.png")} Site d'Égypte antique Le visage du sphinx de Gizeh. Noms en arabe أبو الهول , Abou al-Hôl Localisation Région Basse-Égypte Coordonnées 29° 58′ 31″ nord, 31° 08′ 16″ est Géolocalisation sur la carte : Égypte Sphinx de Gizeh modifier   Le sphinx de Gizeh est la statue thérianthrope qui se dresse devant les grandes pyramides du plateau de Gizeh, en Basse-Égypte. Sculpture monumentale monolithique la plus grande du monde [ 1 ] avec 73,5 mètres de longueur, 14 mètres de largeur et 20,22 mètres de hauteur, elle représente un sphinx couchant. Réalisée vers -2500, elle serait attribuée à Djédefrê, l'un des pharaons de la IV e  dynastie, représentant son père le pharaon Khéops. Sommaire 1 Étymologie 2 Desc...
                              Read more

                              Different font size/position of beamer's navigation symbols template's content depending on regular/plain...

                              Image
                              3 Let's suppose I'd like to divert the navigation symbols template (e.g. in order replace them by the frame numbers, see this bug report ;) I would be facing troubles regarding the font size/position, depending on regular/plain frames, as shown by the following MCE. How could I get rid of these troubles? documentclass{beamer} usetheme{PaloAlto} setbeamertemplate{navigation symbols}{insertframenumber/inserttotalframenumber} begin{document} begin{frame} frametitle{A regular frame} end{frame} begin{frame}[plain] frametitle{A plain frame} end{frame} end{document} beamer header-footer share | improve this question asked Dec 10 '18 a...
                              Read more