I'm wondering what are the nowadays risks of storing a JWT that does not expire in an
localStorage is vulnerable to XSS, and that normal cookies are vulnerable to CSRF, so that's why it's recommended to use temporary JWTs with refresh tokens.
My idea is that the JWT would be issued at login time and would only include the user ID. It would be sent in an
Secure cookie. On logout, the cookie storing it could be overridden by the backend. Additionally, to avoid keeping cookies around when a user does not log out, they could have a
Is it plausible?
Thanks in advance.