About token stored in cookie
after logging in, I store token in cookie
but there is a validity period for token. The validity period set by me in cookie is not consistent with that set at the backend. As a result, sometimes the cookie does not expire and token expires.
all the great gods, where do you usually store your token? And how to solve my problem in general.
token
whether it expires should be judged by the backend API, not by the front end, because the user gets a token
and then uses this token
all the time, and you set the expiration time when the user logs in, which is not allowed.
I suggest that token
is stored on cookie
, and the expiration time is not set. If token
fails, let the backend return a fixed status in the interface to indicate that token
expires. If you need to log in again, just reset token
in cookie
.
js
create cookie
with document.cookie = 'token=221212fsfsfafas'
here is a more convenient and safer way.
ask the backend to add set-Cookie
to the returned value of the interface header
, so that the browser will automatically set token
to cookie
.
also, if the returned value of the API header
is set in Http-Only: true
, the cookie
cannot be directly modified in js
, which is safer.
specifically
what is your token function? Every user needs a token?
in the actual project, the backend usually handles the problem of token expiration. Either the frontend does not set the validity period, or it is set for a long time, and all are handed over to the backend.
give it to the backend for processing, and store it in redis to set the expiration time