@@ -33,6 +33,8 @@ class ApiClient {
3333 private managementClient : AxiosInstance
3434 private catalogClient : AxiosInstance
3535 private polarisClient : AxiosInstance
36+ // Store access token in memory only (not in localStorage for security)
37+ private accessToken : string | null = null
3638
3739 constructor ( ) {
3840 this . managementClient = axios . create ( {
@@ -63,7 +65,7 @@ class ApiClient {
6365 // Request interceptor to add auth token
6466 const requestInterceptor = ( config : InternalAxiosRequestConfig ) => {
6567 const token = this . getAccessToken ( )
66- // Read realm from localStorage, fallback to environment variable for backward compatibility
68+ // Read realm from localStorage (non-sensitive configuration)
6769 const realm = localStorage . getItem ( "polaris_realm" ) || import . meta. env . VITE_POLARIS_REALM
6870
6971 if ( token ) {
@@ -107,16 +109,16 @@ class ApiClient {
107109 }
108110
109111 getAccessToken ( ) : string | null {
110- return localStorage . getItem ( "polaris_access_token" )
112+ return this . accessToken
111113 }
112114
113115 clearAccessToken ( ) : void {
114- localStorage . removeItem ( "polaris_access_token" )
116+ this . accessToken = null
115117 localStorage . removeItem ( "polaris_realm" )
116118 }
117119
118120 setAccessToken ( token : string ) : void {
119- localStorage . setItem ( "polaris_access_token" , token )
121+ this . accessToken = token
120122 }
121123
122124 getManagementClient ( ) : AxiosInstance {
@@ -132,5 +134,4 @@ class ApiClient {
132134 }
133135}
134136
135- export const apiClient = new ApiClient ( )
136-
137+ export const apiClient = new ApiClient ( )
0 commit comments