[random3]

Stop using "Stop using X" arguments, without offering an alternative.

[wg0]

Exactly. So anyone reading can suggest what's the alternative while still using JWT?

I mean how to do it properly?

[chupapimunyenyo]

LocalStorage is enough. The point of using a JWT is to avoid using session cookies. If you store the JWT in a cookie, what's the point? You can just use plain old session cookies. Discord keeps their tokens in localStorage and no riots have happened yet