Amplify token issue

Question

We use Amplify to build a Next.js APP,
a medium-sized e-commerce website.
I use Amplify Auth to do the Sign In feature,
I read the [document](https://docs.amplify.aws/nextjs/build-a-backend/auth/concepts/tokens-and-credentials/),
It will save the tokens in localStorage and use the refresh token automatically.

I am not sure if it is safe for my website. dunno why Amplify doesn't set tokens in cookies
1. Should I change the default settings, then save tokens in cookies?
2. If using cookies to save tokens, how can I set the refresh token by myself efficiently?

Kidd Ip · Answer

Yes, in view of security as priority, compare to local vs. cookies with secure transaction say HTTPS.

For Amplify Gen 2:

```
Amplify.configure({
  ssr: true // Enables cookie storage for authentication tokens
});
```
 For Amplify Gen 1:

```
import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';

cognitoUserPoolsTokenProvider.setKeyValueStorage(new CookieStorage());
```

Taz · Answer

Hey,

Hope you're keeping well.

By default, Amplify stores Cognito tokens in `localStorage` for simplicity, but this can be vulnerable to XSS attacks if your site’s scripts are compromised. For higher security in production—especially for e-commerce—you can configure Amplify to store tokens in **secure, HTTP-only cookies** so they’re not accessible to client-side JavaScript. In Amplify v6 (Gen 2), you can enable SSR mode with `Amplify.configure({ ssr: true })`, which uses cookies automatically. For older Amplify versions, set a custom `CookieStorage` via `cognitoUserPoolsTokenProvider.setKeyValueStorage`. Make sure your cookies have `Secure` and `SameSite=Strict` attributes and that you’re serving over HTTPS.

Thanks and regards,  
Taz

Amplify token issue

Add your answer

Relevant content