How to store the accessToken and refreshToken in nextauth? Currently I am storing them inside session callback. But here the problem is the accessToken and refreshToken are visible in browser, inside session in network tab.
So can you suggest any good practice by which I can store the accessToken securely using nextauth? And how can I access it everywhere where I want.
This is my code for …NextAuth file
0
Your code is not visible in your question, but there may be some misunderstanding.
The tokens are stored in a session cookie for the client, as they are, in theory, “owned” by the client.
They authenticate and authorize themselves with an OAuth provider that provides you with tokens to fetch their data, such as their name or profile picture.
You should set a secret for nextauth that encrypts the JWT so it can not be decoded when intercepted, but in essence, these tokens should be available in the client’s cookies.
Moreover, the next-auth callbacks use the cookies sent by the client to “infer” their state and do not have a state on their own. This is why the callbacks are so important to type correctly and ensure errors are handled, as they function somewhat as middleware between requests.
TLDR; If you need them, they should be stored in a cookie. Depending on how you handle requests (serverside or clientside) they might be actually readable or are encrypted, but ensure you have a secret set for the tokens used.
1