2

I'm using rest API, If I need to access those API endpoints need to authorize JWT Token. JWT tokens don't have any expiration so I can use anytime same token. Calling API through react application. Can anyone please help me with your idea where I can store JWT Token securely?

Improve this question
3
  • JWT tokens don't have any expiration - where did you get this idea? It's possible to create tokens without expiration, but that's usually not the case, most frameworks set an expiration time by default. Commented Feb 24, 2022 at 6:57
  • In my case, JWT doesn't have any automated expiration. So I should not store it cookies or local storage. Can you tell what are all the ways we can do? Thanks for your response. Commented Feb 24, 2022 at 13:03
  • 1
    if possible, you better add expiration. The storage question comes up frequently, I don't think that there's anything to add that hasn't been written before. Commented Feb 24, 2022 at 13:22

1 Answer 1

Reset to default
1

To do it properly, you should use session cookies and not store the tokens in the browser at all.

Instead you should consider using the BFF pattern as described here:

I also just wrote a blog post about this topic: Implementing BFF Pattern in ASP.NET Core for SPAs

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Old question, I know, but wouldn’t you still need to store the auth token locally for the BFF?
You store the tokens on the backend, either in memory or in a database. See my updated answer above about a blog post I wrote about this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.