Amplify token issue

Question

We use Amplify to build a Next.js APP,
a medium-sized e-commerce website.
I use Amplify Auth to do the Sign In feature,
I read the [document](https://docs.amplify.aws/nextjs/build-a-backend/auth/concepts/tokens-and-credentials/),
It will save the tokens in localStorage and use the refresh token automatically.

I am not sure if it is safe for my website. dunno why Amplify doesn't set tokens in cookies
1. Should I change the default settings, then save tokens in cookies?
2. If using cookies to save tokens, how can I set the refresh token by myself efficiently?

Kidd Ip · Answer

Yes, in view of security as priority, compare to local vs. cookies with secure transaction say HTTPS.

For Amplify Gen 2:

```
Amplify.configure({
  ssr: true // Enables cookie storage for authentication tokens
});
```
 For Amplify Gen 1:

```
import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';

cognitoUserPoolsTokenProvider.setKeyValueStorage(new CookieStorage());
```

Amplify token issue

Relevant content