{"action":"created","issue":{"url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/28","labels_url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/28/comments","events_url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/28/events","html_url":"https://github.com/themikenicholson/passport-jwt/issues/28","id":103556046,"number":28,"title":"Support for storing JWT token in a cookie?","user":{"login":"chrismbeckett","id":6036093,"avatar_url":"https://avatars.githubusercontent.com/u/6036093?v=3","gravatar_id":"","url":"https://api.github.com/users/chrismbeckett","html_url":"https://github.com/chrismbeckett","followers_url":"https://api.github.com/users/chrismbeckett/followers","following_url":"https://api.github.com/users/chrismbeckett/following{/other_user}","gists_url":"https://api.github.com/users/chrismbeckett/gists{/gist_id}","starred_url":"https://api.github.com/users/chrismbeckett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrismbeckett/subscriptions","organizations_url":"https://api.github.com/users/chrismbeckett/orgs","repos_url":"https://api.github.com/users/chrismbeckett/repos","events_url":"https://api.github.com/users/chrismbeckett/events{/privacy}","received_events_url":"https://api.github.com/users/chrismbeckett/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-27T17:22:48Z","updated_at":"2015-09-06T05:23:30Z","closed_at":null,"body":"It seems that to protect from both XSS and XSRF, storing tokens in Http-Only/Secure cookies is still being recommended as part of an overall auth strategy. Here is a recent article by Stormpath (among others) suggesting to store tokens in cookies - https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/.\r\n\r\nThe strategy I am looking to implement is to store the JWT token in an Http-Only/Secure cookie with a unique generated XSRF claim, and then store a separate JavaScript accessible XSRF cookie containing the claim that is added as a custom header on each request. On the server, I need to validate the JWT token stored in the cookie, and extract and compare the XSRF cookie value with the XSRF claim stored on the JWT Token (synchronizing token strategy).\r\n\r\nLong story short, it would be a nice feature if this strategy could support specifying and looking for the JWT token in a cookie."},"comment":{"url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/comments/138042491","html_url":"https://github.com/themikenicholson/passport-jwt/issues/28#issuecomment-138042491","issue_url":"https://api.github.com/repos/themikenicholson/passport-jwt/issues/28","id":138042491,"user":{"login":"tjwudi","id":5257816,"avatar_url":"https://avatars.githubusercontent.com/u/5257816?v=3","gravatar_id":"","url":"https://api.github.com/users/tjwudi","html_url":"https://github.com/tjwudi","followers_url":"https://api.github.com/users/tjwudi/followers","following_url":"https://api.github.com/users/tjwudi/following{/other_user}","gists_url":"https://api.github.com/users/tjwudi/gists{/gist_id}","starred_url":"https://api.github.com/users/tjwudi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjwudi/subscriptions","organizations_url":"https://api.github.com/users/tjwudi/orgs","repos_url":"https://api.github.com/users/tjwudi/repos","events_url":"https://api.github.com/users/tjwudi/events{/privacy}","received_events_url":"https://api.github.com/users/tjwudi/received_events","type":"User","site_admin":false},"created_at":"2015-09-06T05:23:30Z","updated_at":"2015-09-06T05:23:30Z","body":"+1 for storing in cookie"}}