Repository navigation
Possibility of XSS Vulnerability with Keycloak Javascript adapter #19483
Unanswered
manu-joseph
asked this question in
Q&A
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
As we plan to use the Keycloak Js adapter with default authorization code grant flow in a SPA application, it was learnt that the adapter (keycloak-js) stores the access token in memory, attached to an instance variable in the Keycloak Js script. Is this pattern vulnerable to XSS attacks, if attacker managed to inject a script to the same domain?
If so what are the possible ways to mitigate this? Is there an easy way of obtaining the access token from Authorization code in a back end service and drop the same as an HttpOnly cookie?
All reactions