Currently I'm working on a React-Laravel stack application. Having already built an SPA using React and a backend in Laravel, the plan is to use the backend as a REST API to make requests from the frontend.

I am using JSON Web Tokens with Laravel Passport in order to achieve authentication. However, storing the auth token in a secure way cannot be done, as both localStorage and cookies are not secure.

My question is this: What alternative route can I take to secure my app (where its security is paramount), having already built out a fair bit of the frontend and backend?

migrated from softwareengineering.stackexchange.com Apr 9 at 17:51

This question came from our site for professionals, academics, and students working within the systems development life cycle.

  • Related: paragonie.com/blog/2017/03/… – Robert Harvey Apr 9 at 17:53
  • 1
    Could you explain why you consider local storage and cookies insecure? – Anders Apr 9 at 18:24
  • Both of which can be tampered with on the frontend by malicious users, e.g. cross-site-scripting attacks. – cameraguy258 Apr 9 at 18:34
  • 1
    Even when the cookies and the local storage is tampered. The attacker cannot set a valid value to there without knowing your secret that used to sign the JWT. They definitely are able to change the stored value. However, the new value will be an invalid one in 99.99% and will be ignored in Passport. – Hieu Le Apr 10 at 15:08
  • So there are no security liabilities in using Passport with a React app? – cameraguy258 Apr 10 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.