|
|
|
|
|
|
by Moneysac
980 days ago
|
|
|
In a single page application you have to access the JWTs with JavaScript. When we use cookies to implement sessions we have attributes like HttpOnly to prevent the cookie from being referenced by JavaScript code. In this case a XSS vulnerability would not be able to simply access the cookie and take over another users session. What I am trying to say here is that JWTs used in single page applications are dangerous because you have no layer of protection against XSS attacks. |
|
|
Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.