Should the token be protected?

Question

JavaScript

Please tell me, is it necessary to somehow protect the token in such a scheme?
I'm creating a one-page site with a "get data" button and a token field.
And there is a third-party service with an API that issues an access token. This token must be inserted into Headers on every request.

To get data from this service, my user copies the token issued to him into a field on my site. I write this token in a cookie and send a normal fetch request to that service, extracting the token from the user's cookie.

So is it safe for the user? Or do I need to use some flags in the request?

Answer 1

There is some interesting reading here about HttpOnly flags to protect your tokens from XSS attacks, SameSite and anti-CSRF tokens.