Strapi JWT Cookies

Securely use users-permissions's JWT on cookies. Compatible with Strapi v4 and requires @strapi/plugin-users-permissions@^4.1.12


How this package works

This package extends the @strapi/plugin-users-permissions core plugin via Extending a plugin's interface. It exports a higher-order function to wrap strapi-server customization.

$3

- Adds two middlewares and applies the jwtCookieSetter middleware to auth routes only, so it wont affect the other routes.
- Adds one route and logout controller to remove cookie server-side: POST /api/auth/logout

$3

- Split JWT into two cookies, httpOnly for JWT header.signature and javascript-accessible cookie for the payload, so frontend can easily read the JWT payload. read it more here
- Automatically log out on user inactivity by setting cookie expires

$3

Note that this package doesn't add a CSRF prevention mechanism, but it does ensure the request is from the frontend by using SameSite flag sets to lax,
and by checking request custom headers which only can be sent from the same CORS domain.

- set X-Requested-With to XMLHttpRequest to be able receive and validate jwt cookies on the server

Install

``bash
npm install --save @wiseops/strapi-jwt-cookie
`

Create file under directory src/extensions/users-permissions/strapi-server.js:

`js
// src/extensions/users-permissions/strapi-server.js

module.exports = require('@wiseops/strapi-jwt-cookie')();

`

If you already extend the strapi-server.js, you could wrap your function like this:

`js
const withJwtCookie = require('@wiseops/strapi-jwt-cookie');

module.exports = withJwtCookie((plugin) => {
// some customization

return plugin
});

`

Then add the global middleware, this middleware reconstructs JWT from request cookies and then assigns it to headers.authorization

`js
// config/middlewares.js

module.exports = [
'strapi::errors',
...
'strapi::public',
'plugin::users-permissions.jwtCookieGetter'
]
`

$3

By default, frontend users will be logged out after 30 days of inactivity (not make an api request)

`bash
COOKIE_PAYLOAD_LIFESPAN_MINUTES=43200
`

You can restrict the cookie to your specific frontend domain (recommended):

`bash
FRONTEND_DOMAIN=myfrontend.com
`

The default cookies name are user for the payload and token for headers.signature, you can prefix the cookies name with env

`bash
APP_NAME=myapp
``

then the cookies will be myapp_user and myapp_token

$3

- [ ] Add test (?)

$3

- Getting Token Authentication Right in a Stateless Single Page Application by Peter Locke