title: React frontend and REST API, CSRF
body: <p>Using React on the frontend with a RESTful API as backend and authorisation by a JSON Web Token (JWT), how do we handle sessions? For example after login, I get a JWT token from REST. If I save it to localStorage I am vulnerable to XSS, if I save it to cookies, same problems except I set cookies to HttpOnly, but React can't read HttpOnly Cookies (I need to read cookie to take JWT from it, and use this JWT with REST requests), also I didn't mention the Cross Site Request Forgery (CSRF) problem. If you're using REST as backend, you can't use CSRF Tokens.</p>
  <p>As a result, React with REST seems like a bad solution and I need to rethink my architecture. Is it possible to offer your users a secure React application that handles all business logic on the REST API side without fear of losing their data?</p>
  <p><strong>Update:</strong></p>
  <p>As far as I understood, it is possible to do this:</p>
  <ol>
  <li>React makes an AJAX call to the REST API</li>
  <li>React gets a JWT token from the REST API</li>
  <li>React writes HttpOnly cookie</li>
  <li>Because React can't read HttpOnly cookies, we use it as-is in all our REST calls where we need authentication</li>
  <li>The REST API calls to check the XMLHttpRequest header, which is some kind of CSRF protection</li>
  <li>The REST API side checks for cookie, reads JWT from it and does stuff</li>
  </ol>
  <p>I lack theoretical knowledge here. The logic looks pretty secure, but I still need an answer to my questions and approve of this &quot;workflow&quot;.</p>