How Do I Keep JWT Refresh Tokens In Cross-Origin Cookies

Question

How Do I Keep JWT Refresh Tokens In Cross-Origin Cookies

Osman Zakir 121

I have a project where I've built a personal library app using the MERN stack, but the server and client are on different URLs on Render.

I'm storing a JWT refresh token in secure HTTP cookies that have the same-site property set to false. But I read under issues in the Edge browser that cross-origin cookies will be blocked in a future update.

How can I resolve this issue? Is there any way for me to address the privacy concerns and avoid having to remove the cross-origin cookie?

Would PKCE help my issue? I remember reading that some ways people use to store JWT refresh tokens aren't secure. Is PKCE included in those?

Accepted answer

0 additional answers

Your answer

Answer 1

Anonymous

Hi @Osman Zakir ,

In my opinion, you can take a look at the CHIPS proposal (Cookies Having Independent Partitioned State). The CHIPS proposal offers a new but more limited escape hatch– a developer may opt-in to partitioning their cookie so that it’s no longer a “3rd party cookie”, it’s instead a partitioned cookie. It then workarounds the issue of third-party cookies, which will be blocked in the future.

CHIPS is now supported by Microsoft Edge.

For more information, you can refer to this MDN doc.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Best Regards,

Shijie Li

Osman Zakir 121 Reputation points

2024-05-15T18:52:13.13+00:00

@Anonymous Would I be correct in assuming that with CHIPs, I can still have the Same-Site property set to "None"? Or do I have to have it set to be same-origin when cross-origin cookies are blocked? Due to me having to use a server that has a different URL, I have to have Same-Site set to "None".
Anonymous

2024-05-16T01:56:16.99+00:00

Hi @Osman Zakir ,

Yes, you can still use SameSite=None.
Osman Zakir 121 Reputation points

2024-05-18T14:39:34.1633333+00:00
@Anonymous I tried this change to my Node.js code to create a partitioned cookie for the refresh token. But I get a 502 HTTP error code now, as well as a CORS error saying there's "No 'Access-Control-Allow-Origin' header is present on the requested resource". Please help. Thanks.

exports.COOKIE_OPTIONS = { httpOnly: true, secure: true, signed: true, sameSite: "none", maxAge: math.evaluate(SESSION_EXPIRY) * 1000, path: "https://personal-library-server.onrender.com/api/users/refreshToken", partitioned: true };
Anonymous

2024-05-20T02:41:37.99+00:00

Hi @Osman Zakir ,

Please check if you have correctly set the 'Access-Control-Allow-Origin' header. You can also try the wildcard if possible.

Share via

How Do I Keep JWT Refresh Tokens In Cross-Origin Cookies

0 additional answers

Your answer