19 lines
493 B
TypeScript
19 lines
493 B
TypeScript
/**
|
|
* In-memory token storage.
|
|
*
|
|
* Access token is kept in memory only (never persisted to localStorage /
|
|
* sessionStorage) to reduce XSS exposure. The refresh token is handled by the
|
|
* backend (HttpOnly cookie), so the client never touches it directly.
|
|
*/
|
|
let accessToken: string | null = null;
|
|
|
|
export const tokenStorage = {
|
|
get: (): string | null => accessToken,
|
|
set: (token: string): void => {
|
|
accessToken = token;
|
|
},
|
|
clear: (): void => {
|
|
accessToken = null;
|
|
},
|
|
};
|