3 ms·
> In a single page application you have to access the JWTs with JavaScript. Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exc
by seandoe 3y ago
> In a single page application you have to access the JWTs with JavaScript.
Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.