> HttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript.
What is wrong with cookie authentication?
What is wrong with cookie authentication?
Using token auth headers can avoid the use of csrf tokens and make your backend only require a single type of auth.