I'm relatively new to authentication and I'm using JWT.io in following manner.

Server Side

Once user logs in, I generate a token with userid embedded inside and pass it back to the user in the message body

Client Side Browser/JS I'm storing the token in localStorage and for each subsequent request, I'm passing the token in the headers.

Authorization: Basic someEncryptedValue

I've also used

X-Auth-Token: someEncryptedValue

Could I use this in a cookie?

Then on the server side, I'm verifying the token against the secret, checking expiry, getting the id out of the token and then serving the request.

Is everything correct in this workflow?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.