I'm trying to figure out how to use JWTs that are transmitted in cookies for an SPA It needs to be in cookies because we want non-ajax requests to also send the jwt, and it should "just work" for all subdomains. I have the cookie with the token being generated and updated fine on the server side. What I'm trying to figure out is how the client side should get at the info (is_logged_in and username of logged in user essentially) and keep that info in sync with the server side cookie life cycle, as I want expiration after say 1 hour of no requests, and it should show up on the browser when that happens. My problem is that the user info I want is in a cookie that is http_only to prevent XSS. I've thought of a couple of options, and would like opinions on what's a reasonable security compromise:
1) send the identical jwt token in two cookies, one used for actual server side auth & auth, which is flagged http_only and secure, and a second one which is identical but is not http_only so the client can decode it to get current user info and expiry time.
2) send the user info in a second cookie that is not http_only and is plain view, but has only username of logged in user.
3) try to have the client keep track of login info on its own, this seems problematic so far and easy to futz up but has no insecure cookies flying around.
I'm thinking I could well be missing some security aspect of the above options, hence asking here. thanks!