Best practice for storing auth token client side

Question

I'm building a frontend/backend separated system where the user 2FA auths in and gets a JWT back to the client side.

I'm using angular and for now I just store that token in $window.sessionStorage and include it in the header of every request to identify/authorize/authenticate the user.

Is there a more secure store this token on the client side? Right now on logout I delete the key client side and mark it disabled in the database, but if the user just leaves the browser there's no guarantee that will happen until the token expires (6 hour expire right now).

Any thoughts on this or other threads that already answered it extremely appreciated!

Answer 1

Maybe you could implement idle timeout on the server and if you see no activity for certain amount of time (say 10 mins) mark the session expired.

Answer 2

[EDITED]JWTs are meant to authenticate stateless applications and not for sessions, e.g., you will need to build an invalidation mechanism to invalidate individual tokens, a feature that is be required if you are using a session-based application1. The best practices for securing a JWT are explained by OWASP JWT Cheat Sheet. For the secure storage, you should take into account the following:

• Storing the JWT in the sessionStorage container, not as a cookie.
• When you want to make use of the token, use JS to add it as 'bearer'.
• Fingerprint your token to prevent sidejacking attacks.