Contents
The first option is the more secure one because putting the JWT in a cookie doesn’t completely remove the risk of token theft. Even with an HttpOnly cookie, sophisticated attackers can still use XSS and CSRF to steal tokens or make requests on the user’s behalf. However, the first option isn’t always very practical.
Is CSRF needed for JWT?
If you put your JWTs in a header, you don’t need to worry about CSRF. You do need to worry about XSS, however. If someone can abuse XSS to steal your JWT, this person is able to impersonate you.
Is SessionStorage vulnerable to XSS?
XSS attacks inject malicious scripts into web applications, and unfortunately, both LocalStorage and SessionStorage are vulnerable to XSS attacks. XSS attacks can be used to get data from storage objects and add malicious scripts to the data stored.
When to use JWT to avoid CSRF attack?
If session-id matches and the timestamp is under the defined token expiry time, the request is allowed. based on the fact that CSRF is only possible if the authentication cookie was sent along with the forged request, we can use JWT authentication to avoid CSRF attack.
How does a server validate a JWT token?
The basic idea is that when user logins, the server creates a unique token for that user session and sends it back to user. The client then includes that token in every subsequence request so the server can validate the token. Because malicious site cannot get this unique token, it cannot perform any request.
Do you need session storage for JWT authentication?
Server does not need to maintain a session storage because all authentication information is stored in JWT, which is stored in client side (browser). because JWT is sent along with the request in the request header, it eliminates the possibility of CSRF. However, JWT authentication has its issues.
Where are CSRF tokens stored in the server?
CSRF token is generated in server and stored in session storage. When a request is issued by the client, the server-side component must verify the existence and validity of the token in the request compared to the token found in the user session storage.