3 ms·
> If you’re using tokens for auth and don’t want to use session cookies That sounds like a self-inflicted problem. Even if you’re using tokens, why not store t
by coder543 5y ago
> If you’re using tokens for auth and don’t want to use session cookies
That sounds like a self-inflicted problem. Even if you’re using tokens, why not store them in a session cookie marked with SameSite=strict, httpOnly, and secure? Seems like it would make everything simpler, unless you’re trying to build some kind of cross-site widget, I guess.
- szastamasta 5y agoI need to work with more than 1 backend :)
- coder543 5y agoThis is such an opaque response, I don't know what else could be said. If you're sending the same token to multiple websites, something feels very wrong with that situation. If it's all the same website, you can have multiple backends "mounted" on different paths, and that won't cause any problems with a SameSite cookie.
- szastamasta 5y agoThen you need a single point of failure that is handling session validation. Without it part of your app might work even without your sessions storage.
- coder543 5y agoYou can store a JWT in a session cookie. You don’t need a SPoF for session validation, if that’s not what you want.