i am testing it on my local cluster

so what is point of security?

😄 i was thinking that it will expose everything, in the live server too :S

How if you are using secure connection?

it means it won't show any thing in the browser or anywhere at client side except my application when i use HTTPS ?

you answered your question it would be saved by user if you want to do that

alright thank you , i was confused when i saw the developer tools network tab and everything was there lol , i am still learning .

Client almost always needs this kind of data

afaik this (even with SSL each client can theoretically access their tokens with a http interceptor) is common in mobile apps and apps in general... this is how spam bots work iirc. spam bot can be given authorization tokens generated from spam accounts, thus it is difficult to create new Google/Facebook accounts since they try to eliminate this by associating each account to a phone number, which cost more for spam bot operators to make spam accounts. But that is my understanding from running twitter bots back in the day... things have maybe changed.