> In a single page application you have to access the JWTs with JavaScript.
Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.
Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.
No comments yet.