Httponly cookie as bearer token - Laravel Passport

user_2127214 0
Viewed 2766

I have began building an application using React JS and Laravel 5.5. I have installed the Laravel Passport and have successfully managed to log my user in and out in my React JS app - but I have been told to look into using httponly cookies for security purposes.

In my working code, I have simply stored the access token in localStorage and sent it to the api using Authorization': 'Bearer ' + token in the axios headers, and this works perfectly. However, when I set a cookie using httponly I can't fetch the value of it (which I assume is exactly the point!) - using react-cookie (from npm), if I log cookie.loadAll() to the console then the only cookie I see is a new XSRF-TOKEN cookie, but not the accessToken cookie I set. So how do I go about sending this token to the api?

laravel-passport axios laravel oauth
3 Answers

Since you can't read the httpOnly cookie from JS, when getting a new token from the backend, the backend has to send the token in the response body.

user_2282690

Browser session cookie usage and bearer tokens are different strategies of authentication (cookie based and token based).

In my opinion they should not be mixed.

Lavavel passport supports authentication with bearer token or with cookie out of the box (see condition at TokenGuard user) You have to use Passport::cookie for this.

In this case you will be able to set cookie and use HttpOnly flag with other attributes to secure them.

user_20476210
Related