在 http 请求中包含网络令牌

Question

I'm using an ajax call to return a json web token on success. There's lots of information from sites like jwt.io that you should then update your http request headers to "Authorization Bearer 'token'" but I have no idea how to do that. I update subsequent ajax calls using ajaxSetup(), but it's not a single page app so I will be using standard http gets and posts afterwards. I'm not using any frameworks like Backbone or Angular. Thanks!

Answer 1

If you are outside the realm of a single page application you could store your token value in the client side context by using a cookie or local storage. Then, your subsequent ajaxSetup methods could retrieve the stored value.

Info on localStorage from MDN: https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage

Answer 2

Once you get the token you store it in localStorage, then redirect to the next page. Get the token in that page and delete it from localStorage. Use it to authenticate once and refresh it, because of xss atacks you need to handle this carefully.