Hey there I am currently working on a little website with angular and express. For Authentification i chose JWT. (I am pretty new to all of this)
After loggin in I create a cookie with express and store the token inside. After reading a lot of articles, the common way to send the JWT from client to server via Authentification Header. But why is that? Can't I just use the token I stored as cookie? I mean you have to store the token anyway and since the cookies are always send to the api i don't see why I should use auth header aswell or did i missunderstand anything here?
In authentication, when the user successfully logs in using his credentials, a JSON Web Token will be returned and must be saved locally (typically in local storage, but cookies can be also used), instead of the traditional approach of creating a session in the server and returning a cookie.
Whenever the user wants to access a protected route, it should send the JWT, typically in the Authorization header using the Bearer schema. Therefore, the content of the header should look like the following.
Taken from https://ponyfoo.com/articles/json-web-tokens-vs-session-cookies
Aucun commentaire:
Enregistrer un commentaire