JWT in HTTP-Only Cookies
Sign JWTs and store them in HTTP-only cookies to prevent XSS token theft.
JWT in HTTP-Only Cookies is a free Sveltejs Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Sveltejs Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
JWT Basics
JSON Web Tokens are self-contained tokens carrying claims signed by your server.
Why JWT
JWTs avoid server-side session storage. The token itself proves identity.
Store in httpOnly Cookie
Set the JWT as an httpOnly cookie to prevent XSS theft.
cookies.set("token", jwt, { httpOnly: true, secure: true, path: "/" });Avoid localStorage
Never store JWTs in localStorage. XSS attacks can read it and impersonate users.
Verifying in Hooks
In handle, verify the token signature and decode claims.
const token = event.cookies.get("token");
try { event.locals.user = verify(token, SECRET); } catch { event.locals.user = null; }Sign with Secret
Sign tokens with a strong secret only your server knows. Never expose it.
Expiration
Set short expirations (15-60 minutes) and use refresh tokens for renewal.
Algorithms
Use HS256 for symmetric or RS256 for asymmetric (public/private key) signing.
Refresh Tokens
Issue a refresh token to obtain new access tokens without re-login.
Logout Strategy
JWTs cannot be revoked instantly without a blacklist. Use short expirations to mitigate.
Libraries
Use jose or jsonwebtoken npm packages for signing/verification.
Quick Check
Where should JWTs NOT be stored?
Recap
Store JWTs in httpOnly cookies, verify in hooks, set short expirations, and use refresh tokens for renewal.
Frequently asked questions
Is the “JWT in HTTP-Only Cookies” lesson free?
Yes — the full text of “JWT in HTTP-Only Cookies” is free to read here on the web, and the Sveltejs Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Sveltejs Academy course, upgrade to CoddyKit PRO.
What will I learn in “JWT in HTTP-Only Cookies”?
Sign JWTs and store them in HTTP-only cookies to prevent XSS token theft. You practise Sveltejs Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Sveltejs Academy?
No prior experience is required. Sveltejs Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “JWT in HTTP-Only Cookies” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Sveltejs Academy lesson?
Yes. Every Sveltejs Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Cookie-Based Sessions
- JWT in HTTP-Only Cookies
- Protected Routes in handle() Hook
- OAuth with SvelteKit and Lucia Auth