JSON Web Tokens (JWT)

JWT

JSON Web Tokens are a very popular way of authenticating applications.

Unfortunately, not many good resources describe how JWTs should be stored on the client-side. Many tutorials and courses recommend storing JWT tokens in the local storage, but they don’t mention an obvious problem with this approach. That is, it’s vulnerable to XSS attacks.

Any JavaScript running in the browser has access to local and session storage, and therefore, none of these are great for storing a JWT token, because they are persistent and keep the same JWT for the whole session even when the page is refreshed. It increases the chance that the token can be stolen and the session hijacked. We could consider using a ...