浏览器插件或扩展程序能否查看页面中运行的javascript变量的值

Question

I want to use something like OAuth Implicit Grant to give the client the access token so that work can be done on the client rather than the server, thus saving me costs.

I don't want to use Implicit exactly. Instead, I want to use Authorization Grant. My server will be first to get the access token, so the browser won't store the token in the history, or logs. The server will send the token to the client via web socket. The client will now have the token in it's javascript runtime.

I am wondering if it is possible for anyone to steal the token. The client is on a trusted website, however, I am wondering if something like a Chrome extension can inspect javasceipt runtime and see the access token's value.

I also wondering if there are any other ways someone could get the access token out of the client's javascript runtime.

Answer 1

It is generally not recommended to use the implicit flow (and some servers prohibit this flow entirely).

If you are building a new SPA , you should consider implementing the new guidance based on authorization code with PKCE.