Are there any security risks to returning a user's JWT in the response body to a
GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a
Flow, in detail:
- User makes
my.com/api/session. The request includes the user's JWT cookie mentioned above.
- Server validates the authentication cookie, and – for authenticated users – returns the JWT in the response body.
Is there a risk of a CSRF attack in browsers that don't support
SameSite:Lax? In those cases, could a malicious site make the
GET request to
my.com/api/session and – if the user is logged into our site – have the JWT cookie automatically included in that request?