I'm building a frontend/backend separated system where the user 2FA auths in and gets a JWT back to the client side.

I'm using angular and for now I just store that token in $window.sessionStorage and include it in the header of every request to identify/authorize/authenticate the user.

Is there a more secure store this token on the client side? Right now on logout I delete the key client side and mark it disabled in the database, but if the user just leaves the browser there's no guarantee that will happen until the token expires (6 hour expire right now).

Any thoughts on this or other threads that already answered it extremely appreciated!


2 Answers 2


Maybe you could implement idle timeout on the server and if you see no activity for certain amount of time (say 10 mins) mark the session expired.

  • You MUST use session limits on JWT since it is subject to MitM attacks. Commented Jan 8, 2017 at 20:10

[EDITED]JWTs are meant to authenticate stateless applications and not for sessions, e.g., you will need to build an invalidation mechanism to invalidate individual tokens, a feature that is be required if you are using a session-based application1. The best practices for securing a JWT are explained by OWASP JWT Cheat Sheet. For the secure storage, you should take into account the following:

  • Storing the JWT in the sessionStorage container, not as a cookie.
  • When you want to make use of the token, use JS to add it as 'bearer'.
  • Fingerprint your token to prevent sidejacking attacks.
  • 2
    Could you maybe provide a bit more context regarding your links (especially the first one). Link only answers are not good.
    – Tom K.
    Commented Apr 11, 2018 at 9:36
  • Thanks for your feedback @TomK I already include it in my answer. Commented Apr 22, 2018 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .