I'm relatively new to authentication and I'm using JWT.io in following manner.
Once user logs in, I generate a token with
userid embedded inside and pass it back to the user in the message body
Client Side Browser/JS I'm storing the token in localStorage and for each subsequent request, I'm passing the token in the headers.
Authorization: Basic someEncryptedValue
I've also used
Could I use this in a cookie?
Then on the server side, I'm verifying the token against the secret, checking expiry, getting the id out of the token and then serving the request.
Is everything correct in this workflow?