7

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the server-side, since httpOnly cookies can only be deleted by the user manually (not an option) or by the Web Server.

How do I accomplish this successfully? Should I somehow redirect to a page which deletes cookies upon clicking on logout? Proof of concept would be great.

Improve this question
4
  • 3
    I'm not really sure what you are looking for because you have all the details in your question. Http-only cookies can't be deleted client side so you have to send the user to a page (aka /logout) where the back end application will delete the cookie. You've already answered your own question. What else are you looking for?
    – Conor Mancone
    Commented Dec 16, 2019 at 13:15
  • @ConorMancone Is the method to accomplish this secure? Only CSRF is an attack surface?
    – Munchkin
    Commented Dec 16, 2019 at 14:40
  • 1
    The problem with JWT tokens is that they can't be invalidated easily. Deleting it doesn't invalidate it.
    – user163495
    Commented Dec 17, 2019 at 14:13
  • 1
    @MechMK1 but they have server-side expiration checking (which I implemented) or am I missing something here?
    – Munchkin
    Commented Dec 17, 2019 at 15:07

1 Answer 1

Reset to default
6

you cannot, you have make another request to backend from there you can remove the cookies.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .