We are developing an angular2 app which authenticates with Salesforce via OAth's user-agent flow. As of now, we are storing the "access token" in the browser's local storage. The main problem we are seeing with the current approach is that, if somebody gets hold of the access token he/she can access/modify the Salesforce data outside of our application.

In order to avoid this security issue, is there any way we can securely handle the access token after authentication in the browser?

1 Answer 1


You can't really stop the token from being used outside of your app. The appropriate response should be to secure the profile/permission sets/sharing settings in your org so that they can't access data they shouldn't. If a user can access data they shouldn't outside of your app, then your security isn't configured correctly. At no point should a user be able to do something outside of your app that they can do inside of your app. Device-level encryption of the token won't help, because if they can get to the token, that means the user already has physical access to the device and/or could reverse-engineer your encryption, since they already have full access to your source code, by virtue of how web browsers operate.

  • The app will be used by the Sales Reps and they have CRUD access on few objects only. But still, I don't want 3party to access token and get hold of sensitive data in Salesforce.
    – Praveen
    Commented Oct 18, 2017 at 4:44
  • @Praveen What particular attack vector are you worried about? Can you explain more? There's only so much you can do regarding security. Are you worried about the user getting the access token, or an unauthorized user? And if they're unauthorized, how did they get it? The more specific you are, the better I can assist you.
    – sfdcfox
    Commented Oct 18, 2017 at 7:05
  • My question is: Is it possible for any unauthorized user/code (part of browser extension) can read the localStorage information of a website?. If yes, then Can we prevent them from reading the sensitive information stored in the localStorage ?
    – Praveen
    Commented Oct 18, 2017 at 14:31
  • @Praveen Yes, extensions can read localStorage if the user permits it. Ergo, the extension would be authorized by the user.
    – sfdcfox
    Commented Oct 18, 2017 at 14:36
  • Is there's any way to we could protect the access token by some sort of techniques like encryption or something else....?. Because the client had some reservation about the current approach.
    – Praveen
    Commented Oct 18, 2017 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .