How to save httpOnly cookie(JWT token) in angular 12

Question

I have a SSO integration which returns a JWT token and I don't want to store this token in local storage for security purposes. I don't want to get it every time from server, what are the possible options?

Does this answer your question? [any idea to setup Cookie parameter 'HttpOnly' using angular](https://stackoverflow.com/questions/59611002/any-idea-to-setup-cookie-parameter-httponly-using-angular) — RomanHDev, Jan 31 '22 at 15:02

score 0 · Answer 1 · answered Jan 31 '22 at 15:22

This is done from the server side in communication with the the browser directly, Angular is not really involved. If the cookie is also httpOnly, only the server side will be able to read/set the cookie.

So to directly answer your question, it sounds like a good idea but it would have to be done on the server side, not the client side.

score 0 · Answer 2 · answered Feb 01 '22 at 10:29

You should avoid storing tokens at all in the browser, as it is a public client and hence not secure at all.

You should instead consider using the BFF pattern, see this videos for more details:

How to save httpOnly cookie(JWT token) in angular 12

2 Answers2