What is the most secure way to store transfer and store a JWT token, or any authentication token in general?
Someone told me it's secure to send the authentication token as a cookie, but I don't understand how this would provide any additional security over just using a plain session ID cookie for authentication, as the browser would include that cookie for all outgoing requests anyway. Have I misunderstood something?
What makes a lot more sense to me, is if the token would be stored in a response header or body, then extracted in the client side programmatically and manually added to each request. There would be no way to intercept the token over HTTPS connection and CSRF attacks are rendered impossible (I would use CSRF token anyway). Of course the authentication token could still be accessed by XSS attack, but isn't the cookie also prone to this attack?
I don't understand how token in a cookie provides ANY additional security over authentication based on simple session ID cookie? Am I missing some information?