Token is stored with localstorage. It happens that since localstorage is accessible through javascript from same domain, the token is vulnerable and a XSS attack can occur.
The best way to store the token is with cookie flagged with httpOnly and secure. httpOnly sets the cookie to be read only on server side. secure sets the cookie to be transfered only under https protocol.
Furthermore, the XSRF attack needs to be avoided with X-XSRF-TOKEN.
Read more: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/
Token is stored with localstorage. It happens that since localstorage is accessible through javascript from same domain, the token is vulnerable and a XSS attack can occur.
The best way to store the token is with cookie flagged with
httpOnlyandsecure.httpOnlysets the cookie to be read only on server side.securesets the cookie to be transfered only underhttpsprotocol.Furthermore, the XSRF attack needs to be avoided with X-XSRF-TOKEN.
Read more: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/