> Modern web applications (so called single page applications) often utilize JSON Web tokens (JWTs) for session handling instead of cookies I had thought the m

> Modern web applications (so called single page applications) often utilize JSON Web tokens (JWTs) for session handling instead of cookies I had thought the main way JWTs are stored and transmitted in a web context is via Cookie/Set-Cookie? > This attack would not be possible with a cookie based session mechanism where attributes like HttpOnly would prevents injected JavaScript Code from accessing the JWTs. You can put the JWT inside the HttpOnly cookie, right? What am I missing?