将 jwt 转换为在 android 应用程序上使用 Cookie(sessionid+csrf Token)

Question

My application requires that only one account can use it. So, My team decided to use session and Cookie because they can control the access. So, the Cookie has sessionid and csrf Token.

As far as I know, Cookie is for Browser. I don't know if it's a good strategy for Native Application. And I don't know if csrf Token is needed for Native app. And also, Cookie seems less safe than JWT.

I get Cookie content from Headers(Set-Cookie) and also send it in Cookie Header & X-CSRFToken Header.

Can you describe the pros and cons, and your opinion about this migration?

Answer 1

From a mobile app perspective using cookies with a session ID doesn't differ much from using opaque access tokens. For the mobile app, it's just a string that you need to get from one place (response body/header, etc.), and put it in another ( Authorization header or Cookie header). All the security features of cookies are implemented by the browser so you will not use them anyway.

As for the CSRF token, you have to remember that the API does not have a way of knowing whether it's the mobile app making the request or the browser. As you will be using cookies it's recommended to also have proper CSRF protection in place.