2

I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the server-side, since httpOnly cookies can only be deleted by the user manually (not an option) or by the Web Server.

How do I accomplish this successfully? Should I somehow redirect to a page which deletes cookies upon clicking on logout? Proof of concept would be great.

  • 2
    I'm not really sure what you are looking for because you have all the details in your question. Http-only cookies can't be deleted client side so you have to send the user to a page (aka /logout) where the back end application will delete the cookie. You've already answered your own question. What else are you looking for? – Conor Mancone Dec 16 '19 at 13:15
  • @ConorMancone Is the method to accomplish this secure? Only CSRF is an attack surface? – Munchkin Dec 16 '19 at 14:40
  • The problem with JWT tokens is that they can't be invalidated easily. Deleting it doesn't invalidate it. – MechMK1 Dec 17 '19 at 14:13
  • @MechMK1 but they have server-side expiration checking (which I implemented) or am I missing something here? – Munchkin Dec 17 '19 at 15:07
1

you cannot, you have make another request to backend from there you can remove the cookies.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.