title: How to secure private routes in SPA while using httpOnly cookies
body: <p>I'd like to secure my SPA private routes with JWT authentication. To make everything as much secure as it's possible, I wanted to use <code>httpOnly</code> cookie to store my <code>access_token</code> on the client-side.</p>
  
  <p>Using <code>httpOnly</code> cookies protect me a lot from XSS attacks, but unfortunately this approach does not allow me to check if the cookie actually exists in the browser.</p>
  
  <p><strong>In this case - how can I implement some logic to prevent unlogged users to visit private, secure routes of my SPA?</strong></p>
  
  <p>Am I forced to use non-<code>httpOnly</code> cookies or <code>localStorage</code> for this?</p>