What if any user stole my accessToken and paste it to his browser cookie storage (using browser delveoper tool) ?

[rudrabhikadiya3]

I am shifted to MERN stack from Next.js developer.

For implementing authentication in my web, I store accessToken in cookies (as usual) and also implemented refreshToken mechanism.

But I have doubt when all the structure and login system(even refreshToken) is depends on accessToken, which is stored in cookie so we can access it from every component of web application. but its also access by any user, that's the problem!

If I logged in my PC(desktop/laptop) and leave my PC and some other guy seat on my pc then he can easily get my token and use it in his own PC by paste my token in cookie storage(using developer tool).

So how you guys prevent from this?

[ptz0n]

Correct, that's how cookies work. There's a few things to consider:

1. Token TTL
2. Use session storage
3. Lock your computer