Storage jwt token in cookie?

[leohxj]

Cookie is easy for a web app, if we consider that use cookie to send jwt token?

but using cookie will be attacked by CSRF， it's another problem.

[yassinebridi]

You can mitigate this by using a refreshed based token.

[leohxj]

Using JWT is a way to authentication, but the client will do some storage code (such as use localstorage API).

If JWT token storage in cookie (set-cookie in server), every request will take this cookie, the server can use mutli ExtractJwt way (extract in cookie or bearer header).

[yassinebridi]

That's why you would only use an httpOnly cookie.