Where should we store the JWT for SPA? Memory, Cookie, or LocalStorage?

Introduction

I develop an SPA application on Django/DWF recently. I used JSON Web Token (JWT) to authorize users for login and other operations. It’s Okay for me to create endpoints with JWT secure, exchange JWT with social medias’ access token.

Build Single page application with React and Django Part 3 — Use JWT with DRF and tests endpoints…

Build Single page application with React and Django Part 5.1-Exchange

However, the security issue is a critical issue for JWT. Where should we store the JWT? I tried some ways and wrote this note.

It includes the following topics.

• The safest place: Browser’s Memory
• Should we store JWT in the LocalStorage?
• Double tokens policy: HttpOnly Cookie + CSRF token
• Summary

1. The safest place: Browser’s Memory