I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) I am only storing the JWT in sessionStorage
.
That JWT is then verified as being valid and current anytime the user navigates between protected routes. If it is still good, it is refreshed. i.e. It is sent from sessionStorage.getItem('token')
to the server, a new one is sent back if the sent one is still valid, and replaces the existing one in sessionStorage
. Cool.
The problem I am have run into is while I have identified the user is allowed to access, and continue accessing, these protected routes, I don't really know who they are and therefore am unable to pull data that is specific to them. (I haven't had luck with using stuff like user = request.user.username
to gather who the current user is and the JWT after the initial issue of the JWT doesn't carry username along with it... from what I can tell.)
So I see two options to resolve this:
1) Store the JWT in the DB with relationship to the user and in sessionStorage
so that it can be called from sessionStorage
, compared against the DB, and then identify the user from that.
It seems like this might be the "safest" option to go.
2) Since the server is already sending back the username
along with the JWT when the user logs in, I can just start storing both in sessionStorage
. That way, I can sessionStorage.getItem('username')
and requests to the server to retrieve user specific information. However, someone could sessionStorage
and get their username. (The JWT's are only good for 15 minutes, and if it meets that time limit, the user is logged out, and sessionStorage.clear()
is done.)
The second one, is what I am concerned about security-wise. I am far from being a security expert, so just curious what the ramifications of storing username
in sessionStorage
is and which of these would be "better".
EDIT: As I continue to read on the subject, I'm finding numerous guides and books that use examples where username
is stored in sessionStorage
. That doesn't make it right though. For example, this lovely example storing username and password in localStorage
(I might be going out on a limb here, but that is a really bad idea):