Avoid refresh token for authentication when using HttpOnly cookie

Question

I have a solution for an authentication system without using refresh token. Please tell me where are the vulnerabilities of this method.

I assume the following:

Client and Server are on the same domain.
Client is a browser that support HttpOnly cookie.
Client is using a Single Page Application.

The steps are:

User login by making a request to /api/auth with the credentials.
Server authenticate the user and send back a Set-Cookie Header with an HttpOnly cookie containing a JWT.
Client receive and set the HttpOnly cookie. Client also set in Local Storage a variable logged: true.
After sometime User reopen the browser. The Single Page Application check if the variable logged in Local Storage is == true. If so check if it still has the HttpOnly cookie by making a request to /api/check-cookie.
Server respond with true if it find the HttpOnly cookie and it is valid. Otherwise false.
Client, if receive false from /api/check-cookie, will prompt the user with the login.

With this approach the JWT can have a long expiration date and there is no need to keep track of refresh tokens.

Am I missing something?

Klh · Accepted Answer · 2022-08-09 06:44:14Z

0

I like your thinking and had similar ideas, particularly with setting a local storage variable to reflect the state as logged in so I could check that before making a pointless server call to refresh a token that potentially doesn't exist, however, I'm still using the refresh token.

I believe the crux of your issues will be when the user updates on the server side, it won't be reflected on the client side until the user re-authenticates with a new long-lasting, singular token as opposed to when the short-lived access token refreshes, setting the user again with the updated data.

answered Aug 9, 2022 at 6:44

Klh

1744 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Avoid refresh token for authentication when using HttpOnly cookie

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related