https://community.spotify.com/t5/Spotify-for-Developers/Using-HTTP-Only-cookies-for-access-tokens/m-p/5523251#M8414 <P><STRONG>My Question or Issue</STRONG></P><P>I have set up a Node app that follows the OAuth authorization flow with PKCE, but I can only receive access tokens in the HTTP response body. Ideally I want to use HTTP-only cookies as I would if I was using my own server to avoid&nbsp;<SPAN>XSS or CSRF attacks. Is there any way to do this with the API without creating my own cookies through a server?</SPAN></P> Sat, 18 Mar 2023 18:51:40 GMT MichaelKeay 2023-03-18T18:51:40Z https://community.spotify.com/t5/Spotify-for-Developers/Using-HTTP-Only-cookies-for-access-tokens/m-p/5523251#M8414 <P><STRONG>My Question or Issue</STRONG></P><P>I have set up a Node app that follows the OAuth authorization flow with PKCE, but I can only receive access tokens in the HTTP response body. Ideally I want to use HTTP-only cookies as I would if I was using my own server to avoid&nbsp;<SPAN>XSS or CSRF attacks. Is there any way to do this with the API without creating my own cookies through a server?</SPAN></P> Sat, 18 Mar 2023 18:51:40 GMT https://community.spotify.com/t5/Spotify-for-Developers/Using-HTTP-Only-cookies-for-access-tokens/m-p/5523251#M8414 MichaelKeay 2023-03-18T18:51:40Z