I am using Angular 8 with Node.js (Express.js) to make a login system. It needs to be secure. I have set the cookies using httpOnly:true, which contain a JWT token and it should be deleted by the server-side, since httpOnly cookies can only be deleted by the user manually (not an option) or by the Web Server.

How do I accomplish this successfully? Should I somehow redirect to a page which deletes cookies upon clicking on logout? Proof of concept would be great.

  • 2
    I'm not really sure what you are looking for because you have all the details in your question. Http-only cookies can't be deleted client side so you have to send the user to a page (aka /logout) where the back end application will delete the cookie. You've already answered your own question. What else are you looking for? – Conor Mancone Dec 16 '19 at 13:15
  • @ConorMancone Is the method to accomplish this secure? Only CSRF is an attack surface? – Munchkin Dec 16 '19 at 14:40
  • The problem with JWT tokens is that they can't be invalidated easily. Deleting it doesn't invalidate it. – MechMK1 Dec 17 '19 at 14:13
  • @MechMK1 but they have server-side expiration checking (which I implemented) or am I missing something here? – Munchkin Dec 17 '19 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.