authentication in client side

[rajeshponnala]

We are currently doing authentication in this by storing user token in the local storage.I understand this is not the right way and need to be changed,is there a right mechanism to do this or should we drop this entire thing and redo from the start.I understand that from next project we would be using the mechanism that srinivas is working on as that is the right way.

[pervezfunctor]

For projects where convenience is more important the security(most projects except govt projects and banking projects), you could store token in localstorage, making sure the following conditions are met

1. Use https only. Else we need to encrypt all important communication.
2. Do not share our domain with projects from other companies. Make sure you use trustworthy and popular javascript libraries.
3. Handle logout correctly by deleting the token from localstorage and invalidating the token
4. have Expiration time for all tokens(on the server)

Also make sure

1. you do not store tokens in database. If you need to, store it the same way you store passwords.
2. If possible, use email id along with token to validate a user.

Note: I will edit this, if I remember something, I have forgotten.