c# - Do I send authentication tokens as JSON response or set them on API (flutter and react client side)? - Stack Overflow

admin管理员组

文章数量:1278825

I am developing a .NET API and want to create front-end applications using React for the web and Flutter for the mobile version. My main concern is how to securely manage authentication tokens (access and refresh tokens) for both platforms.

I am accustomed to appending the tokens directly in the API response, using the access token as a regular cookie and the refresh token as an HTTP-only cookie. However, I am uncertain about how this approach will work with the Flutter app, as it doesn't support cookies like the web application does.

My key concerns are:

Security: I want to ensure the authentication process is secure for both the web and mobile versions of the app.

Ease of use: I want an approach that works smoothly across both platforms without significant complexity.

Could you advise on the best way to handle authentication tokens for both a React web app and a Flutter mobile app, while ensuring optimal security and usability in .NET?

I am developing a .NET API and want to create front-end applications using React for the web and Flutter for the mobile version. My main concern is how to securely manage authentication tokens (access and refresh tokens) for both platforms.

I am accustomed to appending the tokens directly in the API response, using the access token as a regular cookie and the refresh token as an HTTP-only cookie. However, I am uncertain about how this approach will work with the Flutter app, as it doesn't support cookies like the web application does.

My key concerns are:

Security: I want to ensure the authentication process is secure for both the web and mobile versions of the app.

Ease of use: I want an approach that works smoothly across both platforms without significant complexity.

Could you advise on the best way to handle authentication tokens for both a React web app and a Flutter mobile app, while ensuring optimal security and usability in .NET?

• c#
• asp
• flutter

Share Improve this question Follow edited Feb 24 at 16:24 Dharman♦ 33.4k2727 gold badges101101 silver badges147147 bronze badges asked Feb 24 at 15:06 BunnyBunny 2111 silver badge11 bronze badge

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

You should focus more on verifying JWT tokens on the server side, as there’s no more secure way than letting clients store their own tokens. However, storing access tokens in cookies on the client side exposes them to XSS attacks. A better approach is:

For Web (React): Store the access token in memory and the refresh token in an HTTP-only, Secure cookie. For Mobile (Flutter): Store both tokens in secure storage (Keychain/Keystore) since cookies aren’t supported. Also, implement token blacklisting and cache invalidated tokens to prevent unauthorized reuse. Always use short-lived access tokens and verify them on every request.

本文标签：