What are the main vulnerabilities when using JWT authentication in single page apps?

All answers to this question.

The most secure method for handling JWT authentication in single page applications is storing tokens in HttpOnly, Secure cookies with the SameSite attribute set to Strict or Lax. Storing tokens in local storage exposes them directly to cross-site scripting attacks, as any compromised third-party script can read the storage. While cookies do introduce cross-site request forgery vulnerabilities, this can be easily mitigated by validating custom anti-CSRF headers or relying on modern SameSite cookie protections supported by all major browsers.

   Answered 2025-02-02 by Heather Bishop

If we switch completely to HttpOnly cookies, how can our frontend application access the custom user claims embedded inside the payload? Doesn't that force us to make an extra API call just to display the logged-in user's username?

   Answered 2025-02-20 by Dennis Fowler

• Dennis, a standard workaround is to split your token data or send an unencrypted secondary cookie containing just the user profile info for frontend UI rendering. The actual cryptographically signed token stays locked inside the HttpOnly cookie for backend API authorizations.

     Commented 2025-03-19 by Philip Dunn

We avoid cookies entirely by keeping the token strictly in frontend memory and using a silent refresh token exchange hidden inside an invisible iframe.

   Answered 2025-05-05 by Gary Newton

• Gary's approach is excellent for absolute isolation from storage, but it requires solid handling of browser tab sync so users don't lose session state when opening links in new windows.

     Commented 2025-05-12 by Cheryl Knight