[mvf4z7]

My biggest problem with using JWTs for authenticating a SPA is where do you store them so that a user does not have to login every time they visit your application? Every SPA tutorial I have seen says to throw them in the browser's localStorage. Well now you just opened yourself up to XSS vulnerabilities. Any code running on your page can access localStorage and make requests to ship the tokens anywhere they would like.

I prefer session cookies for web applications. Sure you have to worry about CSRF, but that is easily solved with CSRF tokens. Furthermore, is CSRF even really an issue when you are using a JSON API and have CORS properly configured.

[mooreds]

> where do you store them so that a user does not have to login every time they visit your application?

We recommend HTTPOnly, secure cookies for storage with an SPA. Diagrams here: https://fusionauth.io/learn/expert-advice/authentication/spa...

If you need to access APIs from elsewhere, run an API proxy server side that can validate the JWT and then forward on the requests.

[debacle]

Adding a CSRF middleware to your app is something that you need to do once, ever.