在服务器端存储API访问令牌

Question

I have built an app in React that uses the Dropbox API & will be stored on AWS S3 & CloudFront. The app accesses the Dropbox folder using a token. At the moment this token is client-side and obviously is completely accessible.

I have tried reaching out to Dropbox, looked into cookies & HTML5 web storage but can't seem to find a simple explanation.

What would be the simplest way of securing this token on the server?

Answer 1

There are few pros and cons of storing an access token in the server.

However, the most secure way of storing it on your server is sending it to the server via https link.

One major disadvantage of storing an access token in the server is that you, as the owner of the service, is bound to take the responsibility of securing the token. If your server is ever compromised, the hacker gets access to all the data of all the users by having simple access to all their access tokens.

You can always store the dropbox access token on the client side as a storage variable. Each storage is accessible only to the scripts served from the same domain.

~Edit~

If the Dropbox account is owned by the owner of the website and it should be hidden from the end user, you need to operate the Dropbox account from within the server. This DropBox accessing microservice has to be utilized as a proxy for accessing files.