3 ms·

Where else are JWTs coming from? You can't pass the signing key to the client, that defeats the point.

• thdrdt 7y ago
  It has to come as cookie from the server if you don't want to save it with Javascript.
  • shantly 7y ago
    Is there a problem with that? So long as your CORS headers aren't screwed up for your use case, passing JWTs around via cookie headers should be fine, right?