I'm building a frontend/backend separated system where the user 2FA auths in and gets a JWT back to the client side.
I'm using angular and for now I just store that token in $window.sessionStorage and include it in the header of every request to identify/authorize/authenticate the user.
Is there a more secure store this token on the client side? Right now on logout I delete the key client side and mark it disabled in the database, but if the user just leaves the browser there's no guarantee that will happen until the token expires (6 hour expire right now).
Any thoughts on this or other threads that already answered it extremely appreciated!
window.name
"transport" seems to be ram-only... – dandavis Jan 8 '17 at 8:11