Store Laravel Passport access token in a cookie

user_1236183 0
Viewed 2160

Is it safe to store the access token in a cookie?

I've checked, and even if you have the access token, if you are not properly logged in, you will get a 401.

The access token is changing (I'm changing it) every time the user logs in.

The cookie gets destroyed on sign out or on timeout (based on the rememberme option).

Should I anyway store it somewhere else? Where about?

laravel-passport laravel access-token cookies
1 Answers

Yes it's safe, but still you need to add middleware on your routes

Before we are using JWT AUth, this is our solution on frontend side on login page

axios({method: 'post', 
      data: {email: this.email.trim(), 
             password: this.password}, 
             url: '/api/login'})
.then(res => {

    if (res.data.success) {

      // Sets the Cookie Expiration Time to 1 Hour same as JWT Token on the Backend
      var now = new Date();
      now.setTime(now.getTime() + 1 * 3600 * 1000);
      document.cookie = "ut=" + res.data.data.type;
      document.cookie = "api_token=" + res.data.data.token;
      document.cookie = "expires=" + now.toUTCString() + ";"

      // Redirect to a new URL, or do something on success
       window.location.href = "/dashboard";
    }

}).catch(function (error) {
  //error 
});

Any suggestions?

user_11918300
Related