handle login

[zenith sequoia]

Hi, I have a backend using C# for my next.js app.
I want to implement a login and dont really know how to store the jwt token and the user data i get from the backend. Is it a good way to store this data in the localstorage?
I have already tried using next-auth but its not really usable in my case.
I also tried to work with zustand but the data get lost after refreshing the page so its not really usefull.
How do you guys handle this?

[zenith sequoia]

add: i cant really use next-auth cause i have to save data (User can upload some data) and i dont get a userid from response. Also im using mssql and there is no direct adapters from next-auth.

[craggy minnow]

Really, it sounds like storing the token and the user in localStorage is your best bet

And maybe look into refresh tokens stored in cookies

What I've done sometimes is store token/user in LocalStorage but also in global state, so marry those two together then you can check if one exists or not

[wispy wraith]

Using JWT for auth is already questionable (best to use simple sessions). See https://redis.com/blog/json-web-tokens-jwt-are-dangerous-for-user-sessions/

Is it a good way to store this data in the localstorage?

Nope since local storage is exposed to the client. Your less worse bet here would be on cookies with httpOnly

[craggy minnow]

Storing the token in storage is fine if its short lived

And you have some ability to control the token version (i.e a counter against the profile) so on log out that gets incremented

And then refresh token in a http only cookie