On: SPAs Are Dead?

[shock-value]

You can also store a JWT in localStorage and require an additional secure signature for it within a cookie (http-only). Best of both worlds.

[ivoecpereira → shock-value]

If doing that, why not go full-mode and store JWT in cookie with http-only flag?

[shock-value → ivoecpereira]

There are good uses for page content to know what's in the JWT (display username, show logged-in status, etc). Cookies also have stricter size limits. Additionally, cookies by themselves are uniquely vulnerable to CSRF, although I guess these days using SameSite property correctly mitigates that.

[jakelazaroff → shock-value]

You can prevent CSRF attacks by simply requiring a custom HTTP header: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Re...