Is it secure to store JWT in localStorage? The thing is that I tried storing JWT in cookies in NodeJS with httpOnly set to true. But the thing is that I cannot access the cookie in reactJS using universal cookies. Is it true that nodeJS generated cookies with httpOnly set to true is not possible to access on the ReactJS client side?
So, is it secure to store JWT in localStorage? Or it is totally secure because of the token secrets?
Many thanks in advance and greatly appreciated.
Its better not to. The JWT Should stay in cookies with httpOnly. I dont think there is any reason for you to use the JWT at the front, all you have to do is to use withCardentials and it will send it automatically every request. If you have data you need that stored inside the JWT, you create a route that open it and send it back to you(with validation of course).
P.S: the reason that you dont want it to be at the localStorage is that you want it to be safe, that no scripts will be allowed to get those tokens.
