I'm working on my first application and I was sending both access and refresh token (jwt) in the response as I've learned before but the frontend developer does not really know where it can be stored safely as you can find different opinions about localStorage and sessionStorage. I continued investigating and I also read about sending the token not on the response but as a httpOnly cookie.

What really is the best way to send and store a jwt token?


Here is some information from blog.angular-university.io: https://blog.angular-university.io/angular-jwt-authentication/#step4storingandusingthejwtontheclientside

  • Step 3 - Sending a JWT back to the client
    • Where to store a JWT Session Token?
    • Cookies vs Local Storage
  • Step 4 - Storing and using the JWT on the client side
    • Checking User Expiration


Once we receive the JWT on the client, we need to store it somewhere, otherwise, it will be lost if we refresh the browser and would have to log in again.

There are many places where we could save the JWT (other than cookies). A practical place to store the JWT is on Local Storage, which is a key/value store for string values that is ideal for storing a small amount of data.


Never store a JWT token in local / session storage, as this leaves room for XSS attacks. If you must store it somewhere you should do it in a cookie with the HttpOnly and secure flags on.

You can read more about this here and here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.