使用JWT，如何检查Authorization-Header？

Question

i'm completely new to working with JWT and i'm struggling at a certain point:

with ajax requests i can set the authorization-header before the request...ok.

How do i use the JWT for "normal" requests? F.e. when reloading the page or simply following a link.

F.e. if a user isn't logged in, i want to redirect him to a landing-page.

On the server-side i have middleware that checks the JWT from the authorization-header and then either grants permission or redirects to the landing-page, but ofc currently i'm always getting the landing-page, because there's no authorization-header for non-ajax requests.

I'm storing the JWT in localstorage.

What am i missing?

Regards

Answer 1

You can store the JWT in a Cookie. This way they will be sent with every request (including "normal" ones). Here is a code snippet from one of my projects:

func loginHandler(w http.ResponseWriter, r *http.Request) {
    ...
    accessToken := newAccessToken(...) // returns a JWT with fields .Token and .Expires
    cookie := &http.Cookie{
        Name:     "access_token",
        Value:    accessToken.Token,
        HttpOnly: true,
        Secure:true,
        Expires: time.Unix(accessToken.Expires, 0),
        Path:    "/",
    }
    http.SetCookie(w, cookie)
    ...
}

And to retreive the token:

func someHandler(w http.ResponseWriter, r *http.Request) {
    cookie, err := r.Cookie("access_token")
    if err != nil {
        // handle missing cookie
    }
    accessToken := cookie.Value
    ...
}

Note that Cookies are vulnerable to CSRF Attacks.

Further reading: Where to Store your JWTs – Cookies vs HTML5 Web Storage