在通用React应用程序上存储JWT令牌

Question

I have an universal React application using Redux, React-routerV4, MySQL and Sequelize. I am trying to protect some routes, and I'm using Passport for that, like in this tutorial: https://hptechblogs.com/using-json-web-token-react/

Usually with JWT storing on web browser is recommended, because you don't have to make request to the DB everytime you load a route. But in the case of an Application with SSR this is not useful, because the components loaded by the server can't access LocalStorage or SessionStorage .

I am thinking if storing the token in a cookie is better in the case of universal applications… Any idea?

Thanks!

Answer 1

If you need SSR support, storing in a cookie is the better option. Alternatively, you can use libs like node-localstorage , if you don't mind serializing to disk on server-side.

However, storing JWTs in either local storage or cookie is a bad idea - since you're essentially storing username/password in plain sight. If that is a concern, then you should be creating a session identifier (or similar), then store that in a signed cookie with httpOnly flag and then use that identifier to access sensitive information on server.