Ndubuisi Samuel’s Post

View profile for Ndubuisi Samuel, graphic

Smart Contracts / Backend / Frontend Engineer

I have these thoughts about auth tokens in web app. Instead of keeping the token in local storage, what do you think about the following: - Add interceptor to your auth request that sets the token as cookie (you can set this strictly to your app domain or to your host if you have several apps on different sub domains but can use same token) - Add another interceptor that would get token from cookie and sets same to either header or as bearer token (depending on what your backend supports) for every outgoing authenticated request. - Instead of worrying about clearing token from storage, you can set cookie to expire after a time period.

This is exactly how I do it nowadays. Easier than localStorage. Especially now the web JavaScript frameworks are embracing SSR. It’s impossible to share Auth tokens using just localStorage.

To view or add a comment, sign in

Explore topics