How can I keep track of a user's session via JWT without storing it as a cookie or in...
up vote
0
down vote
favorite
I've read in several places that it's not recommended to store a JWT in the browser, either in storage or as a cookie. Even if it was, for the current application I'm developing, we have the JWT stored on a java servlet, and are using a separate React app as a frontend.
I was thinking that I could just give each user an ID in a cookie and then check that their session is still valid by comparing the associated JWT.
Is there some recommended method for keeping track of a user's session with a JWT without actually sending the JWT to the user at any point? Every search I try results in a dozen articles telling me not to send JWT to the browser and store it there, but I wasn't planning to anyway. I'd like to avoid having to handle multiple methods of maintaining a user's session, and the JWT is something that isn't optional at this point.
java reactjs session jwt
asked Nov 9 at 16:33
realmature
2818
add a comment |
up vote
0
down vote
favorite
I've read in several places that it's not recommended to store a JWT in the browser, either in storage or as a cookie. Even if it was, for the current application I'm developing, we have the JWT stored on a java servlet, and are using a separate React app as a frontend.
I was thinking that I could just give each user an ID in a cookie and then check that their session is still valid by comparing the associated JWT.
Is there some recommended method for keeping track of a user's session with a JWT without actually sending the JWT to the user at any point? Every search I try results in a dozen articles telling me not to send JWT to the browser and store it there, but I wasn't planning to anyway. I'd like to avoid having to handle multiple methods of maintaining a user's session, and the JWT is something that isn't optional at this point.
java reactjs session jwt
asked Nov 9 at 16:33
realmature
2818
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I've read in several places that it's not recommended to store a JWT in the browser, either in storage or as a cookie. Even if it was, for the current application I'm developing, we have the JWT stored on a java servlet, and are using a separate React app as a frontend.
I was thinking that I could just give each user an ID in a cookie and then check that their session is still valid by comparing the associated JWT.
Is there some recommended method for keeping track of a user's session with a JWT without actually sending the JWT to the user at any point? Every search I try results in a dozen articles telling me not to send JWT to the browser and store it there, but I wasn't planning to anyway. I'd like to avoid having to handle multiple methods of maintaining a user's session, and the JWT is something that isn't optional at this point.
java reactjs session jwt
asked Nov 9 at 16:33
realmature
2818
I've read in several places that it's not recommended to store a JWT in the browser, either in storage or as a cookie. Even if it was, for the current application I'm developing, we have the JWT stored on a java servlet, and are using a separate React app as a frontend.
I was thinking that I could just give each user an ID in a cookie and then check that their session is still valid by comparing the associated JWT.
Is there some recommended method for keeping track of a user's session with a JWT without actually sending the JWT to the user at any point? Every search I try results in a dozen articles telling me not to send JWT to the browser and store it there, but I wasn't planning to anyway. I'd like to avoid having to handle multiple methods of maintaining a user's session, and the JWT is something that isn't optional at this point.
java reactjs session jwt
java reactjs session jwt
asked Nov 9 at 16:33
realmature
2818
asked Nov 9 at 16:33
realmature
2818
asked Nov 9 at 16:33
realmature
2818
asked Nov 9 at 16:33
realmature
2818
asked Nov 9 at 16:33
realmature
2818
2818
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41
add a comment |
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53229732%2fhow-can-i-keep-track-of-a-users-session-via-jwt-without-storing-it-as-a-cookie%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You must have store the JWT tokens somewhere at client side. I prefer cookies with httpOnly option. Since session ends on tab close.
– Aravind P
Nov 9 at 16:52
@AravindP I can't store some kind of ID on the client side and look up a JWT server-side for each request?
– realmature
Nov 9 at 16:59
The only way you can store anything at all (in a practical sense)on the client side is through a cookie. There is no way you can keep track of users without sessions unless you made database requests with every url they requested which again isn't practical.
– Jonathan Laliberte
Nov 9 at 17:10
@JonathanLaliberte Right.... I'm not asking if there's a way to not store anything. I'm asking if there's a best practice for what to store instead of a JWT. I'm literally just thinking of a keeping map of id to jwt and wondering if there's a smarter way than that.
– realmature
Nov 9 at 17:41