# A way to handle an uppy-auth-token via http-only cookies?

**URL:** <https://community.transloadit.com/t/a-way-to-handle-an-uppy-auth-token-via-http-only-cookies/17468>\
**Category:** Uppy\
**Created:** [February 10, 2025, 3:16pm UTC](https://community.transloadit.com/t/a-way-to-handle-an-uppy-auth-token-via-http-only-cookies/17468 "2025-02-10T15:16:45Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aldeee](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.transloadit.com/aldeee/32/1327_2.png) [@Aldeee](https://community.transloadit.com/u/Aldeee)\
**Post date:** [February 10, 2025, 3:16pm UTC](https://community.transloadit.com/t/a-way-to-handle-an-uppy-auth-token-via-http-only-cookies/17468/1 "2025-02-10T15:16:45Z")

</div>

Hey team,

We have a security issue with the uppy-auth-token handled via localStorage. We don’t want to save the token on the client’s machine, we see a vulnerability here: if user works on the shared machine there is a chance that another user could steal his token.

I looked over the code of uppy and companion and didn’t find a way to handle uppy-auth via a cookie. I found only thumbnail-related logic that works as we’d like other endpoints to work.

Could you please tell me how we can handle uppy-auth-token via http-only cookies without saving it in the client’s localStorage?