I have read that storing the jwt token within the httponly secure cookie is the recommended way to prevent both csrf attacks and xss attacks.
When a user goes to my website they may make an api call like so
POST mygatewayproxy.example/login-service/login
and the request is proxy to the loadbalancer
POST my-login-service-lb.example/login
and finally it hits my service
POST login-service-1.example/login
Can I set an httponly strict secure cookie within my service login-service-1 to a different domain value "mygatewayproxy.example"? My intent is to set the jwt token within the httponly cookie to be used later when making requests to other services.
If the above is possible can I then do the following
when a user goes makes a request to a different service
POST mygatewayproxy.example/different-service/req
and the request is proxy to the loadbalancer
POST different-service-lb.example/req
and finally it hits my service
POST different-service-1.example/req
Will different-service-1.example have access to the httponly cookie with the domain mygatewayproxy.example? Or put another way, will the browser send cookie to my different-service-1. I would like to verify that they are signed in and authorized but this is only possible if a cookie that was set in the login service is sent to this service.
