I have a SPA webapp and spring boot backend. I am using spring security for login ldap authentication and csrf enabled. Now I am a little confuse on how I can implement session management on SPA and make it secured.
Questions:
- I store the user’s first name, last name and login name in a cookie after a successful login in ldap. Is this ok?login name and user’s name since they are not credentials.
- Is CSRF token enough for secured SPA? I read in some blogs that I have to implement Oauth but some blogs said csrf is enough. I am a little stuck on decision.
Hope to give me some light/path to take. Thanks