I have an express API that sends back access and refresh tokens in cookies(httpOnly and Secure), the cookies are sent to a react client, which means they can't be accessed, when I send a get user data request to the API and receive the data and add that to the props, can't the user edit the data and mess with the app. If this is possible, what is the workaround with that? Where should I store the data that is returned from the server then? Cheers, Nav :)
1 Answers
Almost a year late...
This is how I fixed it back then, I stored the cookies without httpOnly, and then I read the cookie values using some javascript, and then I sent the value to the server in the Authorization Header.
Then, I read the value on my express server with the req.headers['authorization'] or req.haeders.authorization variable, and then used that value for authentication.
Related