Should I return JWT tokens on a login route even if I am using cookies?

Question

I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to cookies. The login route on my API returns the JWT token pair back to the client (and the refresh token route returns the new access token).

As far as I understand, a attacker could do an XmlHttpRequest on the refresh token route while the user is logged in, and then access the new access token from the response. Is this true, is it a security issue, or can I keep returning the tokens (and also send the tokens in cookies)?

Answer 1

Cookie-based authentication is considered relatively insecure also.

While JWT offers protection against CSRF attacks, they do leave you vulnerable to XSS attacks. This is due to the fact that a malicious party could potentially execute a script to retrieve the JWT.

Conversely, embedding a token inside a cookie can effectively safeguard you against XSS attacks. However, the drawback is that it leaves you susceptible to CSRF attacks, as these tokens are automatically transmitted with each request by default.

The most comprehensive security approach is to incorporate both methods: placing the JWT token into a HTTP-only cookie.

In terms of securing the refresh route, there are several strategies that can be implemented. For instance, you could require the current token to be sent to the route. Subsequently, you could implement logic to embed it in the cookie. This approach renders the token useless to an attacker who doesn't already possess a prior JWT token.