If youre using access tokens, make sure to implement the following:
Use strong authentication mechanisms like OAuth 2.
Discription
0 or OpenID Connect for your API calls. If you cant use these standards, use JWT (JSON Web Tokens) with a secret key that is not exposed in your codebase or client-side libraries.
Generate and invalidate access tokens properly. Dont leak them via server logs or other vulnerabilities! Learn more about how to do this here
https://t.co/FV7Bmbpi18
References
Back to Main
