[Audit] Stop persisting OIDC tokens in localStorage by default

[RaminNietzsche]

Background

C07/#350 improved API-key session defaults. OIDC residual was not filed then.

Problem

src/lib/oidcStorage.ts persists access (and optional refresh) tokens in localStorage. XSS or shared-browser access can steal IdP session material — higher impact than API keys alone.

Proposed solution

• Default access token to memory or sessionStorage with short TTL
• Avoid persisting refresh tokens in JS storage; prefer BFF / HttpOnly cookie where feasible
• Mirror Ops UX “session vs remember” from API-key flow

Acceptance criteria

• Default: tokens not written to localStorage
• Refresh-token persistence removed or explicit opt-in with warning
• Client tests cover storage modes

Priority

P1 / High

Complexity

Large

Evidence

src/lib/oidcStorage.ts (setStoredOidcTokens)

[github-actions]

The issue highlights a security concern where OIDC tokens (access and refresh) are being stored in localStorage, exposing them to risks like XSS attacks or shared-browser access. To address this, the proposal recommends defaulting to safer storage options like memory or sessionStorage, avoiding refresh token storage in JavaScript, and adopting HttpOnly cookies where feasible. The changes aim to enhance security while ensuring usability, with acceptance criteria focused on eliminating default localStorage usage, making refresh-token storage optional with warnings, and implementing robust client tests. Priority is high, but implementation is complex.