Decoupled frontend (SPA) and backend: JWT authentication + persistent login

2
votes

On localhost:3000 I'm hosting a Node/Express app that saves users in Mongo. On localhost:8080 I'm trying to host an AngularJS frontend SPA for it. I've implemented JWT authentication for securing my backend API endpoints but I don't want to send the token in the Authorization header as that doesn't offer me persistent login.

By Googling I've learned that the best place to store a JWT is an HttpOnly cookie. This works fine for Postman but Chrome won't set the cookie on localhost:8080, as I believe different ports count as different domains, and so Chrome won't do what I want because it would be a security flaw.

What's my best course of action here? I feel pretty stuck. Is there a way to implement secure JWT authentication for a decoupled frontend and backend app and still offer persistent login? Even if I drop the JWT I still won't be able to set cookies across different domains, no?

2
node.jsangularjsexpressauthenticationjwt

2 Answers

1
votes

My problems were due to a fundamental misunderstanding of how I should build such an app and what my architecture should be.

The solution, which I'm sure is common sense and obvious to many :) is simply to set up a Node server for the backend API, let's say on localhost:3000, and another Node server which serves a static page in which the frontend JavaScript framework of choice (in this case AngularJS) is injected to make it a single-page app. This second server is instructed to proxy all requests beginning with /api or something similar to localhost:3000.

0
votes

Ensure your protocol is https, cookies with HttpOnly and Secure properties won't be included on plain http calls.