I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that:
You might think an HttpOnly cookie (created by the server instead of the client) will help, but cookies are vulnerable to CSRF attacks. It is important to note that HttpOnly and sensible CORS policies cannot prevent CSRF form-submit attacks and using cookies require a proper CSRF mitigation strategy.
The article above suggest an elaborate two JWT tokens, only one is set as cookie and used to refresh the other which is used for authentication.
On the other hand, I see that implementation of real world app (what medium use) saves JWT in httpOnly. So I'm confused about what is considered to be the industry standard way to implement JWT in fronend?