jeudi 17 janvier 2019

JWT - Why use Auth Header?

Hey there I am currently working on a little website with angular and express. For Authentification i chose JWT. (I am pretty new to all of this)

After loggin in I create a cookie with express and store the token inside. After reading a lot of articles, the common way to send the JWT from client to server via Authentification Header. But why is that? Can't I just use the token I stored as cookie? I mean you have to store the token anyway and since the cookies are always send to the api i don't see why I should use auth header aswell or did i missunderstand anything here?

In authentication, when the user successfully logs in using his credentials, a JSON Web Token will be returned and must be saved locally (typically in local storage, but cookies can be also used), instead of the traditional approach of creating a session in the server and returning a cookie.

Whenever the user wants to access a protected route, it should send the JWT, typically in the Authorization header using the Bearer schema. Therefore, the content of the header should look like the following.

Taken from https://ponyfoo.com/articles/json-web-tokens-vs-session-cookies




Aucun commentaire:

Enregistrer un commentaire