I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that:

You might think an HttpOnly cookie (created by the server instead of the client) will help, but cookies are vulnerable to CSRF attacks. It is important to note that HttpOnly and sensible CORS policies cannot prevent CSRF form-submit attacks and using cookies require a proper CSRF mitigation strategy.

The article above suggest an elaborate two JWT tokens, only one is set as cookie and used to refresh the other which is used for authentication.

On the other hand, I see that implementation of real world app (what medium use) saves JWT in httpOnly. So I'm confused about what is considered to be the industry standard way to implement JWT in fronend?

  • Cookies are a reasonable place a JWT token. Make sure to set the SameSite flag and include proper CSRF mitigation.
    – user163495
    Nov 18, 2021 at 19:29

1 Answer 1


If keeping access or refresh tokens in-memory is insufficient you will inevitable have to compromise towards exposing additional attack vectors. This is the sole reason refresh tokens come to use to rotate or renew access tokens used to access protected resources. Persisting refresh tokens across sessions requires storing them in the browser. Cookies are certainly not ideal here but when working on web browsers they are likely the best option you get if taken care of properly.

  • Only serve cookies over HTTPS (set the Secure flag)
  • If possible, set the Cookie to HttpOnly to avoid having them exposed to malicious script.
  • If possible (as mentioned in the linked article) use the SameSite attribute to ensure sensitive cookies are only served inside your own domain.

Whether these configurations are feasible depends on whether you are utilizing third-party identity providers or not. Some of these expose the aforementioned refresh token through cookies anyway.

  • What is the industry standard about storing cookies? Do sites like medium refresh tokens?
    – Kodoxa
    Nov 18, 2021 at 16:04
  • Here[datatracker.ietf.org/doc/html/rfc6265] is the RFC on cookies from which the above answer is a very compromised gist. The 'industry standard' corresponding to access tokens and renewal is described in the OAuth specs [datatracker.ietf.org/doc/html/rfc6749] which is the basis for virtually an authorization scheme utilizing JWTs. As for the comment: medium might use refresh tokens (don't have an account to confirm), one thing safe to assume is that the utilize cookies to keep sessions open with their (or 3rd party) authorization servers.
    – Beltway
    Nov 22, 2021 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .