I have weeks working on login functionality, and I am avoiding with persist an user session. I thought about using LocalStorage, but it would be vulnerable to CSRF attack, and I don't know how could I do that.

I'm working with React.js(frontend), Express.js (backend)

CodePudding user response：

You can store the user token in httpOnly cookie. More details how-to-secure-jwt-in-a-single-page-application

CodePudding user response：

You can encrypt your token before saving in local storage.

After retreiving the token decrypt it and use it.

I use the same method currently.