Hey everyone! I'm wrapping up an application I've been developing for a client over the past eight months. I built the entire thing on my own, using mainly online resources for guidance, despite being a computer science grad. As we get closer to launching, I've been really anxious about the app's security, especially since this is my biggest solo project to date. I have about three years in software development, but I mostly worked on internal tools or CMS projects in the past.
For this app, I utilized FastAPI for the backend, MySQL for the database, and React with ShadCN on the frontend. The app is a single-page application (SPA) that allows for multiple accounts. Here's a summary of the authentication flow:
- Users log in via the frontend, receiving an access token and a refresh token from the backend.
- Access tokens go in session storage while refresh tokens are in local storage.
- Multi-account data, including tokens, is stored as an array in local storage.
- Access tokens expire after 15 minutes, whereas refresh tokens last for 30 days, with refresh token rotation in place (the old token becomes invalid after use).
- If an old refresh token is detected, all sessions for that user are invalidated.
- I've also planned to implement a strict Content Security Policy (CSP) to tackle XSS risks since some tokens are in local storage.
However, I've read that storing tokens in local storage might not be the best practice. I'm worried I might need to rethink the security model, but I have also reached the point where major changes would compromise the project's architecture. So, considering my setup, should I be worried about security, or is it good enough to launch? This is really keeping me up at night!
4 Answers
It’s a good idea to consider hiring a penetration tester who can identify specific vulnerabilities in your app instead of just relying on forum opinions. They can provide you with actionable insights tailored to your setup.
You can store refresh tokens in httponly cookies, which means the client won't have access to these tokens directly. It adds an extra layer of security without changing the core functionality.
You shouldn't reinvent the wheel when it comes to authentication. Using the FastAPI OAuth2 flow is a solid choice! Just make sure to review it properly for any gaps.
Your implementation sounds reasonably secure for most applications. With refresh token rotation and a strict CSP, you're on the right track. Focusing on details like rate limiting and cookie settings like SameSite could also enhance security. It's normal to feel overwhelmed, but you've put in a solid effort, so don't overthink it too much!
Related Questions
How To: Running Codex CLI on Windows with Azure OpenAI
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically