Django-安全地存储用户API会话令牌

Question

I have an application which issues a simple request with basic auth which returns a session token. I then want to use that token for subsequent calls to that same application interface.

My question is, is it OK to store this token in the session/cookie of the logged in user, or should I approach this a different way? I want to ensure 100% user security at all times.

Answer 1

A session cookie is not a bad solution. You could also mark the cookie as "secure" to make sure that it only can be sent over https. It is far better than using ie localstorage.