Passing token form server to client side and storing in secure way

Question

I did my authentication at server node.js using passport.js and got the token. in order to render a page at client i need token to pass along with an image URL which i want to show on the client side. How can i securely pass the token from server to client using Express framework.

Answer 1

The standard way is to use an https connection and send it as plain json data.

For storage, your options are Cookies and Local Storage. This article from 2016 recommends using cookies with the HttpOnly cookie flag set.

To dig deeper, this StackOverflow question and answer compares the security of the two options, with no strong recommendation either way.