Search code examples
reactjssingle-page-applicationloopbackjsloopback

LoopBack 3 and SPA - where should I store the token?

I have some questions about the login process in LoopBack 3 and modern SPA

  1. The access token generated from users/login is JWT?
  2. How to properly (safely) store a token generated from users/login on the modern SPA side? Just save them in localStorage or Cookies and after reading, attach them to API queries?
Solution

    1. The accessToken generated by Loopback is not a JWT. It does not contain encrypted user data.

    2. You could store it as a cookie on the browser and attach it to subsequent API queries.

    Usually I use Redis to store my accesstokens so that the server can be stateless. This is a better solution if you have autoscaling configured.