jwt authentication: cookie vs header

Question

There are a lot of articles around discussing what is the best place to store JWT on the clientside. In short, they're all about -

• Http-only secure cookie - no XSS, but vulnarable to XSRF

• Header (saved in local storage or DOM) - no XSRF, but vulnarable to XSS

I think I come up with an extremely savvy solution to this, but, since I'm complete noob in security I'm not sure if it's really savvy or stupid.

So, what if to split JWT and save part of it in the cookie and another part in the header? Would it be unbreakable?

This should also solve 'logout' problem - deleting header portion would make browser incapable of logging in.

Answer 1

The JWT needs to remain together, otherwise the signature validation won't work.

Protecting against XSRF is pretty easy, you just need another cookie.

Never use local storage for storing authentication information, it doesn't follow the same domain and origin rules as cookies. Read more here:

https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet#Storage_APIs

Disclaimer: I work at Stormpath, we have a hosted user management solution and we spend a lot of time on security. I've written two blog posts where I discuss JWTs and front-end auth:

Token Based Authentication for Single Page Apps (SPAs)

https://stormpath.com/blog/build-secure-user-interfaces-using-jwts/