Using JWT instead of Cookie on SSL enabled site

Question

Instead of using a cookie I'm using a JWT token which gets send with every request. Every request is a POST request so that the token does not get saved in the browser's history.

It's a single-page app.

The token looks like:

{
    userId: 12345678,
    expires: <UNIX timestamp>,
    otherInfo: <something>
}

Everything is SSL secured. The token is created on the server when the user logs on.

Would this be a good way to replace a cookie or do you see any flaws?

Answer 1

No, this is not a good solution. Using cookies (with a httpOnly flag) for cross-request persistence is not optional - it's the only way to safely store session credentials, in such a way that on-page JavaScript code cannot access it directly.

This is essential to prevent eg. session stealing in an XSS attack, by ensuring that scripts cannot access the credentials, but they can still be used in requests to the server.

Your use of JWT doesn't seem to really solve a problem, either - why can't you just use session cookies using an existing session implementation? This kind of thing is precisely is what they're made for.