3 ms·
I don't think that you can. The CSRF token must either be in the headers or the meta tags. Storing it inside the JWT cookie would defeat the purpose (unless you
by superasn 8y ago
I don't think that you can. The CSRF token must either be in the headers or the meta tags. Storing it inside the JWT cookie would defeat the purpose (unless you are not using cookies at all in which case you don't have to).
- bosyr 8y agoJWT don’t have to be in a cookie. It may very well be a bearer token in the Authorization header as well. I would assume that is the most common use of a JWT, but that is just an assumption.