I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) I am only storing the JWT in
That JWT is then verified as being valid and current anytime the user navigates between protected routes. If it is still good, it is refreshed. i.e. It is sent from
sessionStorage.getItem('token') to the server, a new one is sent back if the sent one is still valid, and replaces the existing one in
The problem I am have run into is while I have identified the user is allowed to access, and continue accessing, these protected routes, I don't really know who they are and therefore am unable to pull data that is specific to them. (I haven't had luck with using stuff like
user = request.user.username to gather who the current user is and the JWT after the initial issue of the JWT doesn't carry username along with it... from what I can tell.)
So I see two options to resolve this:
1) Store the JWT in the DB with relationship to the user and in
sessionStorage so that it can be called from
sessionStorage, compared against the DB, and then identify the user from that.
It seems like this might be the "safest" option to go.
2) Since the server is already sending back the
username along with the JWT when the user logs in, I can just start storing both in
sessionStorage. That way, I can
sessionStorage.getItem('username') and requests to the server to retrieve user specific information. However, someone could
sessionStorage and get their username. (The JWT's are only good for 15 minutes, and if it meets that time limit, the user is logged out, and
sessionStorage.clear() is done.)
The second one, is what I am concerned about security-wise. I am far from being a security expert, so just curious what the ramifications of storing
sessionStorage is and which of these would be "better".
EDIT: As I continue to read on the subject, I'm finding numerous guides and books that use examples where
username is stored in
sessionStorage. That doesn't make it right though. For example, this lovely example storing username and password in
localStorage (I might be going out on a limb here, but that is a really bad idea):