DEV Community

Discussion on: Understand JWT in 3 minutes

Collapse
 
tahazsh profile image
Taha Shashtari

Updated the post. Thanks for pointing this out.

Collapse
 
exadra37 profile image
Paulo Renato

You can use localStorage to store it, but that would open your app to XSS attacks. A better choice is cookies.

Thanks for the update, but you can improve it a little more, by telling to set the
cookies with the httpOnly flag set, otherwise we are back to the same issue of Javascript be able to steal it.