Hide Tokens from client side "Front-end"

Question

I have an ASP .net core API that has some tokens like JWT, refresh tokens, ..etc I want somehow that hide these tokens from frontend like angular for security issues Is there a way to do this

Rijwan Ansari · Answer

I don't think that you can hide the token as you have to pass it in api calls. However, you can secure access by implementing CORS. So, you can restrict access of api with CORS. https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0

Rijwan Ansari · Answer

Check these article for BFF. This is used mostly for microservice architecture. https://nordicapis.com/building-a-backend-for-frontend-shim-for-your-microservices/. https://samnewman.io/patterns/architectural/bff/

Kiran Mohanty · Answer

Instead of storing in local storage or cache, you can store the token in a static property of client side service . But still user can see token in networks tab. For that you need to define custom logic to avoid pressing F12 or open developers tool.

assa aff · Answer

I heard from some that it's a way to do this with BFF "backend for frontend" so any idea about how to implement this BFF for web API

Madan Shekar · Answer

see any how once user login you will recevied the token from the server and further operation you will keep it in local storage or cookie. Now the question is anyone can read the value from the cookie or local storage. solution is before storing in local storage or cookie encrypt the token.