So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. OAuth is not an option) I could set the duration to say 30 days (is this a reasonable duration or should it be shorter?), then every time the user accesses the site a new token is set. This would mean that users visiting the site more than 30 days apart would need to relogin, but other than that it would be user friendly and secure from my understanding?
One thing I'm not sure about is the format of the token, since typically JWTs can't be revoked from my understanding, so would a long (128bit?) random string be sufficient instead?
User logs in -> Generate token -> Push token to DB with the users ID (1 token per user, remove any existing tokens?) -> Set cookie to token.
User starts browser -> Get token from cookie -> Search DB for matching tokens -> accept / reject
User accesses resource -> Get token from cookie -> Search DB for matching tokens -> Get associated user ID -> Authorize if permitted to access resource
User logs out -> Search DB for token, remove entry