What I want:
- Store a JWT in localStorage. The JWT contains claims about authorization.
- Prevent the JWT from being stolen and used by an attacker (using XSS)
- Avoid CSRF
Storing the JWT in localStorage is bad since exploiting XSS would lead to a stolen JWT, which an attacker could use for authorization.
Storing JWT in http only cookie is bad since it doesn't have enough space for the claims.
A possible solution is to:
- Create a http only cookie with a sessionId
- Store JWT in localStorage with the same sessionId encrypted inside
- On the server, verify that the sessionId in the JWT and the cookie matches before using the claims.
This way the JWT can be stolen, but cannot be used unless the attacker also has the sessionId from the cookie. Also, CSRF is not possible since a cookie is not enough for authorization.
Are there any flaws with my reasoning? Are there any easier ways to accomplish the same thing?