Httponly cookie 作为不记名令牌 - Laravel Passport

Question

I have began building an application using React JS and Laravel 5.5. I have installed the Laravel Passport and have successfully managed to log my user in and out in my React JS app - but I have been told to look into using httponly cookies for security purposes.

In my working code, I have simply stored the access token in localStorage and sent it to the api using Authorization': 'Bearer ' + token in the axios headers, and this works perfectly. However, when I set a cookie using httponly I can't fetch the value of it (which I assume is exactly the point!) - using react-cookie (from npm), if I log cookie.loadAll() to the console then the only cookie I see is a new XSRF-TOKEN cookie, but not the accessToken cookie I set. So how do I go about sending this token to the api?

Answer 1

由于您无法从 JS 读取 httpOnly cookie，因此当从后端获取新令牌时，后端必须在响应正文中发送令牌。

Answer 2

Browser session cookie usage and bearer tokens are different strategies of authentication (cookie based and token based).

In my opinion they should not be mixed.

Lavavel passport supports authentication with bearer token or with cookie out of the box (see condition at TokenGuard user ) You have to use Passport::cookie for this.

In this case you will be able to set cookie and use HttpOnly flag with other attributes to secure them.

Answer 3

Httponly cookie as bearer token doesn't make much sense. Having cookies httponly helps to protect you and the user against XSS attack as their not readable by javascript. They can be used eg for storing session information and are sent when the user do eg a page reload.

Setting Authorization header to 'Bearer ' + token is correct way how to sent token to the api. Before using token on the api server you should always check if the token is still valid.