I’ve spent some time studying about this, and I do know it is a widespread subject, however I hoped to get some suggestions on my authentication method.

I’ve an SPA. It must authenticate to 1) my utility backend and a pair of) some APIs on AWS. I am utilizing cognito to authenticate consumer credentials.

My thought on approaching that is as follows:

1. Person authenticates through AWS Cognito API
2. Receives JWT
3. Retains JWT in reminiscence solely (no native storage — XSS)
4. Passes JWT to utility backend
5. Backend units HTTP-only safe cookie on the shopper, STORING the JWT inside this cookie.
6. Cookie is used to take care of classes with the app backend
7. In-memory JWT is used to authenticate with AWS APIs

That is fine-and-dandy, however when the consumer closes browser or switches tabs, they will not have the JWT in reminiscence. Nonetheless, they will nonetheless have the session cookie. So my thought is that it’ll ask the applying server for the JWT (contained in the cookie) earlier than hitting the AWS APIs.

On this style, I’ve a safe HTTP-only cookie that maintains classes with my app server, and I even have the JWT to authenticate with the AWS APIs. If the consumer has a sound session cookie, it means they need to allowed to have the JWT contained inside it.

My solely concern with that is that it appears slightly round. JWT authenticates to obtain cookie, which authenticates sooner or later to obtain a refreshed JWT. In any other case, I feel it appears fairly strong.

Ideas?