vue-realworld-example-app icon indicating copy to clipboard operation
vue-realworld-example-app copied to clipboard

Published 20 hours ago • verified publisher icon gothinkster

Do not store JWT in HTML5 Local Storage

Open christophwolff opened this issue 7 years ago • 2 comments

The HTML Local Storage can be compromised because it can be read by JavaScript and the same Domain. (XSS) Use Cookies instead. They are not accessible by JavaScript.

Ref.: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage

christophwolff avatar Apr 15 '18 10:04 christophwolff

@christophwolff So the best way is to use httpOnly cookies. What is running on the server side in order to set the Cookie: header? Similarly, the XSRF cookie requires server support.

dmethvin avatar May 03 '18 17:05 dmethvin

Or just don't commit them to local storage and set them in the Vuex store in memory:

  • https://auth0.com/docs/security/store-tokens#don-t-store-tokens-in-local-storage
  • https://community.auth0.com/t/why-is-storing-tokens-in-memory-recommended/17742

akrawchyk avatar Sep 03 '19 18:09 akrawchyk