About token stored in cookie

after logging in, I store token in cookie

clipboard.png

but there is a validity period for token. The validity period set by me in cookie is not consistent with that set at the backend. As a result, sometimes the cookie does not expire and token expires.

all the great gods, where do you usually store your token? And how to solve my problem in general.

Mar.09,2021

token whether it expires should be judged by the backend API, not by the front end, because the user gets a token and then uses this token all the time, and you set the expiration time when the user logs in, which is not allowed.

I suggest that token is stored on cookie , and the expiration time is not set. If token fails, let the backend return a fixed status in the interface to indicate that token expires. If you need to log in again, just reset token in cookie .

js create cookie with document.cookie = 'token=221212fsfsfafas'

here is a more convenient and safer way.
ask the backend to add set-Cookie to the returned value of the interface header , so that the browser will automatically set token to cookie .

also, if the returned value of the API header is set in Http-Only: true , the cookie cannot be directly modified in js , which is safer.


specifically


what is your token function? Every user needs a token?


in the actual project, the backend usually handles the problem of token expiration. Either the frontend does not set the validity period, or it is set for a long time, and all are handed over to the backend.


give it to the backend for processing, and store it in redis to set the expiration time

Menu