Announcements
From 28th September 2026, Community private messages will no longer be available. If you have any private messages you'd like to keep, please save or copy them using these steps before this date. Thank you.

Help Wizard

Step 1

NEXT STEP

Using HTTP-Only cookies for access tokens

Using HTTP-Only cookies for access tokens

Avatar of MichaelKeay
Casual Listener
2023-03-18 07:51 PM

My Question or Issue

I have set up a Node app that follows the OAuth authorization flow with PKCE, but I can only receive access tokens in the HTTP response body. Ideally I want to use HTTP-only cookies as I would if I was using my own server to avoid XSS or CSRF attacks. Is there any way to do this with the API without creating my own cookies through a server?

0 Likes
Reply
0 Replies

Suggested posts

Let's introduce ourselves!

Hey there you,   Yeah, you! 😁   Welcome - we're glad you joined the Spotify Community!   While you here, let's have a fun game and get…

ModeratorStaff / Moderator/ 5 years ago  in Social & Random