# Client Side ReAct **URL:** \ **Category:** Questions\ **Created:** [September 22, 2021, 7:06pm UTC](https://devforum.okta.com/t/client-side-react/16283 "2021-09-22T19:06:32Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bdarling](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@bdarling](https://devforum.okta.com/u/bdarling)\ **Post date:** [September 22, 2021, 7:06pm UTC](https://devforum.okta.com/t/client-side-react/16283/1 "2021-09-22T19:06:32Z")
I am looking to build a react front end / [asp.net](http://asp.net) core web api backend with SSO. There is a great starter article on this and your NPM package is great, but the problem is that is stores the token in browser storage which is a big no no for security. So what is the best way to accomplish this without storing the raw token in browser storage? Thanks! ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [September 22, 2021, 7:12pm UTC](https://devforum.okta.com/t/client-side-react/16283/2 "2021-09-22T19:12:26Z")
You could store it on the server and use good ol’ fashioned cookies to establish the session between your frontend and backend. This blog post shows how to do it with an Angular + Spring Boot (Java) backend. > **[Angular + Docker with a Big Hug from Spring Boot](https://developer.okta.com/blog/2020/06/17/angular-docker-spring-boot)** > > Use Docker to build & deploy an Angular app! Includes how to combine Angular + Spring Boot into a JAR, dockerize it, and deploy to Knative + Cloud Foundry. Specifically, see the [Combine Your Angular + Spring Boot App into a Single JAR](https://developer.okta.com/blog/2020/06/17/angular-docker-spring-boot#combine-your-angular-spring-boot-app-into-a-single-jar) section. ---
**Author:** ![bdarling](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@bdarling](https://devforum.okta.com/u/bdarling)\ **Post date:** [September 22, 2021, 7:20pm UTC](https://devforum.okta.com/t/client-side-react/16283/3 "2021-09-22T19:20:35Z")
Thanks, that was my thought and everything I read pointed me to that solution… So I very much appreciate having a real example to work from!!! ---
**Author:** ![bdarling](https://avatars.discourse-cdn.com/v4/letter/b/8797f3/32.png) [@bdarling](https://devforum.okta.com/u/bdarling)\ **Post date:** [September 22, 2021, 7:35pm UTC](https://devforum.okta.com/t/client-side-react/16283/4 "2021-09-22T19:35:49Z")
@mraible I am new to doing this on the client side (aka building spas)… Is my concern valid? Or is using the Authorization Code flow with PKCE enough security? I understand with this flow it prevents a malicious user from being able to take the code and exchanging it for a token… but at the end of the day, the token is still stored in browser storage. What is the best practice? ---
**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\ **Post date:** [September 22, 2021, 9:13pm UTC](https://devforum.okta.com/t/client-side-react/16283/5 "2021-09-22T21:13:44Z")
If your SPA doesn’t have a backend it controls, then you’re stuck with Auth Code Flow + PKCE. It’s typically enough security if you have a good content security policy and prevent 3rd party scripts from accessing your app. If your SPA has a backend it controls, my recommendation is to do the authentication there. That’s how we do it in [JHipster](https://jhipster.tech). ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 8, 2024, 7:26pm UTC](https://devforum.okta.com/t/client-side-react/16283/6 "2024-02-08T19:26:12Z")
Closed on February 8, 2024, 7:26pm UTC This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.