3 ms·

> you could store a JWT in a cookie, if you wanted to. Huh? If it's an HTTPOnly cookie, how would you then insert the JWT token into the auth header?

• thosakwe 8y ago
  If you’re using a cookie to store the JWT, you don’t really need to check the auth header.
  • jordache 8y ago
    if you're wrapping the JWT in a cookie, then it's effectively a session cookie. In that case, the client side difference between JWT and session cookies are effectively moot.