Contents
The first option is the more secure one because putting the JWT in a cookie doesn’t completely remove the risk of token theft. Even with an HttpOnly cookie, sophisticated attackers can still use XSS and CSRF to steal tokens or make requests on the user’s behalf.
How do I store JWT tokens in HttpOnly cookies?
Store your access token in memory, and store the refresh token in the cookie: Link to this section
- Use the httpOnly flag to prevent JavaScript from reading it.
- Use the secure=true flag so it can only be sent over HTTPS.
- Use the SameSite=strict flag whenever possible to prevent CSRF.
Is it safe to store JWT in session storage?
A JWT needs to be stored in a safe place inside the user’s browser. To reiterate, whatever you do, don’t store a JWT in local storage (or session storage). If any of the third-party scripts you include in your page is compromised, it can access all your users’ tokens.
Is it safe to store JWT token in Cookie?
Do not store your token in LocalStorage or SessionStorage, because such token can be read from javascript and therefore it is vulnarable to XSS attack. Do not store your token in Cookie.
Is it safe to store JWT in localStorage?
Based on my understanding: localStorage is subjected to XSS and generally it’s not recommended to store any sensitive information in it. With Cookies we can apply the flag “httpOnly” which mitigates the risk of XSS. However if we are to read the JWT from Cookies on backend, we then are subjected to CSRF.
Why are JWT cookies not protected against XSS?
You are still not protected against XSS because what the attacker can do is inject script that reads your CSRF cookie (which is not HttpOnly) and then make a request to one of your API endpoints using this CSRF token with JWT cookie being sent automatically.
Where to store JWT in browser, how to protect against CSRF?
If the JWT is stored in localStorage/sessionStorage, then there is no cookie involved so don’t need to protect against CRSF. The question is how to send the JWT to the server. I found herethat it is suggested to use jQuery to send the JWT by HTTP header of ajax requests.