Can you explain for the dumb, where is the authorization token stored for http-headers that are returned to the client from the server?

CodePudding user response：

It depends on the application.

The authorization endpoint usually responses with the tokens in a response body (JSON).

The frontend application parses that body and stores tokens in LocalStorage or CookieStorage. For single page apps, tokens can be stored in the app's memory (variables).

Access tokens are being read by the frontend app from that storage, and they're being put into Headers of WebServices API calls.

CodePudding user response：

You can check the same in the browser's network tab under "Response Headers" (provided you have set the response header from your server end) :