4 ms·
Im curious how many newer JS+API applications still use browser cookies as a means of authenticating API requests and how prevalent cookie usage still is for th
by parhamn 8y ago
Im curious how many newer JS+API applications still use browser cookies as a means of authenticating API requests and how prevalent cookie usage still is for these types of applications?
JWT/tokens + Local/session storage + adding fetch headers seems like the best way as long as you don't run untrusted JS.
- philcockfield 8y agoLocalStorage is so much more preferable than cookies, I agree, however as SSR ("server-side-rendering") of heavy client-side JS apps becomes more prevalent, suddenly cookies are back in business. If the initial SSR needs some initial client-state to complete its work before sending the HTML payload, it can see the cookie, but not localStorage.
- anthuswilliams 8y ago"as long as you don't run untrusted JS" is a surprisingly tough hurdle to hit, even for very experienced developers. What is your reason for preferring JWT + localStorage for authentication and session handling? I'm genuinely curious, as httpOnly cookies strike me as better in every meaningful way.