How to store a JWT token inside an HTTP only cookie?
<p>I have created an app that simply uses a JWT sent by the server upon correct login credentials, and authorizes against any <code>/api</code> route on my backend Express.js server. </p>

<p>AngularJS, on the other hand, took this token, stored it in session storage, and used an auth interceptor every go around to send the token back to the server.</p>

<p>I've more recently come to understand how dangerous this practice is.</p>

<p>I understand the transfer method of tokens back and forth, in this scenario. However, would someone be so kind as to explain, at a high level, the method that takes place when you want to store that JWT inside a secure, HTTP only cookie that the client side Javascript cannot read?</p>

<p>For example: upon credential success</p>

<ol>
<li>cookie is created on server,</li>
<li>create a JWT at the same time as the cookie</li>
<li>store the JWT in a cookie property called token etc..</li>
</ol>

<p>I'm trying to gain a mental model here of how it works. If my understanding is correct, doing it this way wouldn't require an auth interceptor anymore because upon correct credential login, the server would do all of the transferring of the token inside the cookie.</p>