Why and how to cookies instead of localStorage for our JWT in SvelteKit/Svelte

If your SvelteKit (or any frontend) app can, it should probably use httponly secure Cookies to store your JWT/session information rather than using localStorage. It's more secure against XSS. In this episode, I show you the small changes required to make that work in Svelte.

🤯 Support on Patreon

⏱️ Timestamps:
* 00:00 - Introduction
* 00:45 - Demo
* 02:25 - svelte file changes

💌 Newsletter:

🪐Elsewhere:

💭Concepts:
* Cookies vs LocalStorage for JWTs

📚Resources:

🎬 Subscribe!

My name is David W Parker and I’m creating and publishing videos on ProgrammingTIL to help teach anyone and everyone who wants to code. I’m a huge fan of Ruby on Rails, Svelte, TailwindCSS, and WebGL. I’ve used React a lot in the past, as well as some Vue and AngularJS. I’ve done some professional Python and Django. I like to create real applications and my tutorials will walk you through how to build something real from beginning-to-end.

#svelte #sveltekit

[iamdavidwparker]

Note: the SvelteKit demo app has some usage of cookies via getContext. I'll be covering that soon!

[stephenthumb]

How's the server side for this? Is this for known domains only?

[kissinsightsanalytics]

CSRF is important, require when using jwt cookies-based auth with secure, HTTPonly?

[ThatGuyAnonymous]

Great video. But Just in case we still want to use Local Storage. Any idea on how we should proceed to access it from the load function? I'm not using SSR for reasons that'll be too long to type in this comment (I do know the benefits of it).

Any help related to this specific issue would be great!