title: Cookie vs token based authentication for SPA?
body: <p>I'm building an Single Page App using AngularJS and Spring for backend.
  For the purpose of making my backend stateless, i recently researched on JWT(JSON Web Tokens). Now here's the confusion - </p>
  
  <p>a. Should i send my JWT on response header to client and then save it to cookie through ngCookie ? If yes, how can i handle XSS attacks ?</p>
  
  <p>b. Should i send the JWT in a cookie generated in backend and set cookie on client browser ?</p>
  
  <p>c. Is JWT secure ? (Since I can decode JWT so easily, by the way , I'm gonna run my app on https)</p>
  
  <p>If there's a better way of securing my app, I'd love to know that. </p>
  
  <p>Thank you.</p>
  
  <p>Please share any bit of info.</p>