UserDefaults Storage – Security Concern

[floschliep]

Hi there,

I was glancing through the implementation of SuperTokensURLProtocol and noticed that you're using UserDefaults to store various sensitive user data (access token, refresh token, etc).

UserDefaults is generally not considered secure storage on Apple Platforms and it's best practice use use Keychain Services for this.

Is this a known issue to you and are you planning on fixing this?

[rishabhpoddar]

Hey @floschliep thanks for this issue. It's a valid concern. We will add it to our timelines to fix it, but it's unknown at the moment. This issue may not be that serious cause the access token's lifetime is generally small, we use rotating refresh tokens to detect refresh token theft.

That being said, we are open to accepting PRs :)