Tensei: The Ultimate guide to JWT client side authentication (Stop Using Local Storage !!!)

The most common practice in the industry today is to save JWT in local storage or cookies. This is not secure, and there's a much better way to do this.

In this video I will show you all about it using the Tensei JS framework as our backend provider.

Thank you so much for watching this. Means a lot to me, and I hope you got some value.

[rickybarabba]

The missing part of any JWT courses. Thank you.

[GeordyJames]

I know everyone is hyping that don’t store tokens in local or session storage. But the reality is if your application is vulnerable to XSS attacks then an attacker can high jacks your tokens stored even in http only cookie by triggering an fetch request to his malicious domain with credentials set to true. So I personally think that we should give more focus on preventing any sort of XSS vulnerabilities in our site rather than deciding where we store our tokens. Personally I prefer session storage as it expires when user closes browser tab. Also please note that I am not saying that author is completely wrong. This is a good quality video. Just saying that this approach will also fails if we have XSS vulnerability.

[ifeoraokechukwu]

Hello Franz, very nice video!! Great content too! However, you left out something. The cookie holding the refresh token is still susceptible to CSRF attacks. And once that happens, it’s game over. HttpOnly alone won’t save the cookie from CSRF attacks. You need additional settings on the refresh-token cookie 🍪 for GraphQL. Namely: Path: /graphql; Domain: localhost:4500; SameSite: Strict. Now, with these additional settings, the refresh-token cookie is not vulnerable to CSRF via abuse of ambient authority on cross-site, cross-domain scenarios

[rizadwiandhika]

Damnn!! this is what every JWT newbie needs to know how to understand the refresh token & its usage in the front end 🔥. Thank you Sir!!!

[uziqmyk]

I searched a lot about these refresh token and access token, finally, I understood what's going on. Thank you sir

[MikeBrownphx]

This was/is a phenomenal video. Though not titled microservices, this is the only video that I've found that helped me with the front end side of handling APIs. Thank you for making this.

[callegarip]

You went the extra mile. All the rest in YouTube were lazy or lacking of knowledge or maybe just not as clear as you are. Thanks for your video man!

[ozzyfromspace]

Wow, this is the probably the best discussion of how to securely store user credentials in the browser. I thought this approach made sense, but everyone seems to use local storage or cookies so I let it go. You just confirmed my intuition, and more! Thanks Kati, you’re awesome🙌🏽😎☝🏽. Ofc Im subbed 😁🎊

[aydnbilgin]

Thanks for the kind words, I'm always happy to help! Let know if you'd like any videos on specific topics in the future. I wish you all the

[OleksandrDanylchenkok]

Thanks so much! Every time was missing why the refresh token is even should be used

[Skillthrive]

You do a really great job explaining. It flows really well and you cover a lot without getting too much into the weeds.

[Lindaine]

I've been looking for this!!!! I saw an article by Hasura and I tried it but I can't seem to fully complete it, thank you so much!!

[francisf.massaquoijr.]

This is the best I have watch so far on jwt auth.

[aydnbilgin]

Thank u so much, interested in starting so soft during quarintine and just need a place to get started, thx for the support

[desaawa]

Damn, this is really good man! So much I've learned here that I need to use in my apps going forward!

[rajatpratapsingh]

Important thing to highlight that such an approach is great for web browser applications but not a good idea to follow it if we are creating same Auth API for IOS or Android as they don't have the cookies mechanism.

[lotkutv]

tysm almost a week I searching about the refresh token huhu finally you saved me tysm!

[AnuragPradhan]

Problem with this method is, if someone gets the refresh token, they may infinitely keep on getting new tokens.
One would say, to tackle this issue, keep the expiry time of small duration.
However, it’ll create another issue. Suppose, if I shut down my system and come back the next day, the refresh token would have expired by now. Therefore, I’ll have to log in again.
What could be the potential solution to such problems?

[tomate]

But an attacker could make a request to his own server and then read the refresh token? Or am I thinking wrong

[Daniel-nbkk]

Thank you for addressing this topic, there is a lot of misinformation out there. :)