JWT with cookie

[u-can-miracle]

Hi. I send jwt by cookies with enabled httpOnly flag so user can't set them from browser.
As I saw before you recomend use localStorage for this case. but some one can stole jwt from localStorage
In my case I have ease access to jwt from server and any access from browser as I see it's more secure.
So, why you recommend to use localStorage?

[Teebo]

The only advantage of using a cookie is the one you've mentioned, because I am using localStorage I make sure that the jwt expires in a short period and I do not put sensitive data with the jwt

[jschr]

Another advantage to storing the JWT in a cookie is if you need server-side rendering with an auth context.