4 ms·

Cookies have been battle tested and are very secure. Enable http only mode and you can’t even access them from JS thus eliminate possibility of take over / toke

by moltar 7y ago

Cookies have been battle tested and are very secure. Enable http only mode and you can’t even access them from JS thus eliminate possibility of take over / token theft.

shantly 7y ago
You can store & pass JWTs in cookies, provided they're not huge.
- thdrdt 7y ago
  But the server must send them.
  - shantly 7y ago
    Where else are JWTs coming from? You can't pass the signing key to the client, that defeats the point.
    - thdrdt 7y ago
      It has to come as cookie from the server if you don't want to save it with Javascript.
      - shantly 7y ago
        Is there a problem with that? So long as your CORS headers aren't screwed up for your use case, passing JWTs around via cookie headers should be fine, right?