If cookie-based authentication is used with REST API, how can the same API be used with mobile apps?

user_2556140 0
Viewed 347

I am developing a SPA web app with REST API using Node. I read in many sources that the JWT should not be stored in localStorage of the browser; but instead should be set using cookie with httpOnly flag set. I have also read that mobile apps and SPAs should used token-based authentication.

If I should use token-based authentication, where should I store the token in the client?

While setting cookie is possible to do in web client, how can I use the same REST endpoint when I develop clients for mobile? I am not sure if mobile apps use the concept of cookies.

Suggestions would be highly appreciated.

token mobile rest authentication cookies
1 Answers

I think your application should check cookies for the token first, if it is not there, then check the request Authorization header.

user_48065690
Related