Contents
A simple solution is that we split JWT token into two cookies, one that holds payload and one with signature and header data. Payload cookie should have httpOnly flag set to false and signature.header cookie must have httpOnly flag set to true. Here is a diagram that shows the whole flow.
Why is javascript safe from HttpOnly Cookie attacks?
The next time the user arrives on the site, the SPA gets a 401/403 response (since the session has expired), then takes the user to the login screen. Because the cookie has the HttpOnly flag, JavaScript would not be able to read its contents, so it would be safe from attacks as long as it is transmitted over HTTPS.
How does cookie based authentication work in ReactJS?
The ideal mechanism seems to be cookie-based authentication using HttpOnly cookies that contain session IDs. The flow would work like this: User arrives at a login page and submits their username and password. The server authenticates the user and sends a session ID as an HttpOnly response cookie.
What kind of authentication is used in Spa?
Or in other words, multipage applications have a so-called stateful authentication approach and SPA have a stateless one. The most common SPA’s data layer is provided by the REST API.
A simple solution is that we split JWT token into two cookies, one that holds payload and one with signature and header data. Payload cookie should have httpOnly flag set to false and signature.header cookie must have httpOnly flag set to true.
What should be included in a JWT for authentication?
If JWTs are used for Authentication, they will contain at least a user ID and an expiration timestamp. If you would like to know all the details about the JWT format in-depth including how the most common signature types work, have a look at this post JWT: The Complete Guide to JSON Web Tokens.
Where does JWT go in the request header?
On every request to server, the JWT will be read from Cookies and added in the Authorization header using Bearer scheme. The server can then verify the JWT in the request header (as opposed to reading it from the cookies). Is my understanding correct? If so, does the above approach have any security concern?