It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now we have localStorage/sessionStorage, Single-Page Applications, completely stateless APIs with JSON Web Tokens inside
Authorization: Bearer headers,
__Host- ; HttpOnly; SameSite=Strict; Secure cookies,
X-Frame-Options: DENY headers and so on.
However, despite all these improvements, a JWT stored in sessionStorage is still vulnerable to XSS whereas storing it in a cookie would still make it vulnerable to CSRF on old browsers and Cross-Origin API calls.
Would it make sense to split the JWT on the server side, have the signature sent as a cookie while the rest is held in sessionStorage, and later reassemble them on the server side for verification? Would there be any downsides or security issues about it? Would it be overkill?