Are API tokens safe inside a Flux (Redux) store?

Question

Would it be safe to store an API token returned by an authentication call in a Flux (specifically, Redux) store? I've used Webpack to compile all assets in the project, which I believe means the store is scoped out of reach from third-party scripts looking to read the store and extract the token.

And, for what it's worth, the token is sent over HTTPS in an Authorization: bearer ... header.

Boughton

Absolutely not. At least not unless it's okay for your API key to be viewed by anyone. Anyone can access the data in clientside JS at any time (eg: chrome dev tools). – Hairy

Read this; #20963773 – Crypto

Answer 1

If untrusted 3rd party scripts are running on the page, then you should assume that nothing is safe as the entire integrity of the page is compromised.

If only trusted scripts are running, then you can assume your token is safe, subject to the security of the browser and how secure your site is against XSS attacks.

EDIT:

To clarify, this is safety from 3rd party scripts. If you are trying to hide your token from the user themselves then the answer is that it will always be insecure, no matter how much you obfuscate your code since if the user's machine has access to it, then ultimately the user can have access to it (you can make it more difficult, but not impossible).

Despondent

@Boughton I'd like to add to this that nothing stored in JS should ever be assumed to be secure, because any script with access to your page could in theory be given access to the script/scope. I agree with Trevor; this really boils down to how well you trust the scripts running on your page. – Unsheathe