{"action":"created","issue":{"url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/34","repository_url":"https://api.github.com/repos/marmelab/javascript-boilerplate","labels_url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/34/comments","events_url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/34/events","html_url":"https://github.com/marmelab/javascript-boilerplate/pull/34","id":134837323,"number":34,"title":"[RFR] Cookie-based token storage (without DB)","user":{"login":"Kmaschta","id":1819833,"avatar_url":"https://avatars.githubusercontent.com/u/1819833?v=3","gravatar_id":"","url":"https://api.github.com/users/Kmaschta","html_url":"https://github.com/Kmaschta","followers_url":"https://api.github.com/users/Kmaschta/followers","following_url":"https://api.github.com/users/Kmaschta/following{/other_user}","gists_url":"https://api.github.com/users/Kmaschta/gists{/gist_id}","starred_url":"https://api.github.com/users/Kmaschta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kmaschta/subscriptions","organizations_url":"https://api.github.com/users/Kmaschta/orgs","repos_url":"https://api.github.com/users/Kmaschta/repos","events_url":"https://api.github.com/users/Kmaschta/events{/privacy}","received_events_url":"https://api.github.com/users/Kmaschta/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-02-19T11:01:37Z","updated_at":"2016-02-22T15:47:15Z","closed_at":"2016-02-19T17:25:14Z","pull_request":{"url":"https://api.github.com/repos/marmelab/javascript-boilerplate/pulls/34","html_url":"https://github.com/marmelab/javascript-boilerplate/pull/34","diff_url":"https://github.com/marmelab/javascript-boilerplate/pull/34.diff","patch_url":"https://github.com/marmelab/javascript-boilerplate/pull/34.patch"},"body":"In order to avoid XSS and CSRF attack, we need to store\r\na unique session ID in a http-only cookie.\r\nFor more details, see\r\nhttp://www.redotheweb.com/2015/11/09/api-security.html\r\n\r\nThe only difference with the specified method is that\r\nwe do not have a DB table to store the unique session ID.\r\nInstead, we encrypt the JWT token with a new secret key\r\nand store it in the cookie.\r\nThis way, at each API call, we can crypt again the specified JWT\r\nand check wether it corresponds to the cookie token.\r\nSince the JWT is deleted at end of the session, so is the cookie token.\r\n\r\n## TODO\r\n- [x] Cookie-based token storage\r\n- [x] Use localStorage instead of sessionStorage\r\n- [x] localStorage token and cookie token expiration\r\n\r\n## Preview\r\n\r\n![payload](https://sc-cdn.scaleengine.net/i/7a0de8ecae646dcd721fd8ffafc30764.png)\r\n\r\n![cookie](https://sc-cdn.scaleengine.net/i/918cfa98a3e4eeeea64ca02f603d1740.png)"},"comment":{"url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/comments/187238449","html_url":"https://github.com/marmelab/javascript-boilerplate/pull/34#issuecomment-187238449","issue_url":"https://api.github.com/repos/marmelab/javascript-boilerplate/issues/34","id":187238449,"user":{"login":"fzaninotto","id":99944,"avatar_url":"https://avatars.githubusercontent.com/u/99944?v=3","gravatar_id":"","url":"https://api.github.com/users/fzaninotto","html_url":"https://github.com/fzaninotto","followers_url":"https://api.github.com/users/fzaninotto/followers","following_url":"https://api.github.com/users/fzaninotto/following{/other_user}","gists_url":"https://api.github.com/users/fzaninotto/gists{/gist_id}","starred_url":"https://api.github.com/users/fzaninotto/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fzaninotto/subscriptions","organizations_url":"https://api.github.com/users/fzaninotto/orgs","repos_url":"https://api.github.com/users/fzaninotto/repos","events_url":"https://api.github.com/users/fzaninotto/events{/privacy}","received_events_url":"https://api.github.com/users/fzaninotto/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T15:47:15Z","updated_at":"2016-02-22T15:47:15Z","body":"seems ok"}}