Signed-in state.
WHAT THE FRONTEND IS RESPONSIBLE FOR
Presenting sign-in Holding whatever the session uses Showing appropriate interface for the user Handling expiry
WHAT IT IS NOT RESPONSIBLE FOR
Deciding what the user may do.
WHY
Anything the browser decides can be altered.
WHAT TO PREFER FOR SESSIONS
Cookies set by the server, inaccessible to scripts.
WHY
Tokens held in browser storage are readable by any script on the page.
WHAT THAT MEANS
A scripting vulnerability becomes a session theft.
WHAT TO HANDLE
Expiry, gracefully rather than with an unexplained failure Refreshing, where the scheme supports it Sign-out, clearing everything
WHAT TO DO ON EXPIRY
Return the user to sign-in, preserving where they were.
WHY
Losing their place and their work is avoidable.
WHAT TO NEVER DO
Rely on hiding interface elements for security Store anything sensitive in browser storage Decode a token and trust its contents for authorisation
WHAT TO CHECK
That protected routes verify with the server, not only locally.
