title: Where to store access token for frontend use
body: <p>I have a liberty server with a web app and a <code>REST API</code>. </p>
  
  <p>Both are secured by <code>openid</code> connect on the <code>Liberty server</code>. The api accepts access tokens for authentication. The web app is not entirely frontend so I would need liberty to handle the authentication.</p>
  
  <p>I was thinking of storing the access token in a cookie and having the frontend read the cookie and add the token to any api calls. Is there a better alternative? </p>
  
  <p>With the javascript readable cookie, I need to be careful with <code>XSS</code>.</p>