AUTHOREA
Log in Sign Up Browse Preprints

Alec Aivazis edited In_most_cases_in_order__.html  over 8 years ago

Commit id: 2a115d59795ee01bd46e2a9093feeb355232e2da

deletions | additions      

       

In most cases, in order to achieve persistance, an additional storage mechanism is required whose lifetime exceeds the memory stack to store the session data. The two most common approaches are href="https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie" target="_blank">cookies or href="https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie">cookies or  href="https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage" target="_blank">local href="https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage">local  storage. For a good comparison of the two for storing JWTs see href="https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/" target="_blank">this href="https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/">this  blog post.
 post. Summary: local storage is susceptible to xss and cookies are susceptible to csrf. Since csrf protection is standard in most backend and xss is a bit tricker, I opted to store my JWT in a cookie with the HttpOnly, and Secure flags.