title: Do I have to store tokens in cookies or localstorage or session?
body: <p>I am using React SPA, Express, Express-session, Passport, and JWT.
  I'm confused about some of the different client-side storage options to store tokens: Cookies, Session, and JWT / Passport.</p>
  
  <p>Do tokens have to be stored in cookies, even if I can store them in <code>req.sessionID</code>?</p>
  
  <p>Many websites use cookies to store shopping cart tokens. So far I have stored shopping cart data based on the session ID without adding any cookies.</p>
  
  <blockquote>
    <p>So when users visit my website, I will match it with their
    <code>req.sessionID</code> and then retrieve the data in the database like shopping carts and user session.</p>
  </blockquote>
  
  <p>Do I need to store cookies? I can access it via <code>req.sessionID</code> to get the data needed.</p>
  
  <p><strong>And the second</strong></p>
  
  <p>I have made authentication using a <code>passport-google-oauth20</code>.After I successfully login, the data is saved into the session. and to send it to the client I have to send it via the URL query <code>?token='sdsaxas'</code>. </p>
  
  <blockquote>
    <p>in this case I get a lot of difference of opinion. someone saved it
    into local storage and someone saved it into cookies by converting it to a token using JWT.</p>
  </blockquote>
  
  <pre><code> jwt.sign(
          payload,
          keys.jwt.secretOrPrivateKey, 
          {
              expiresIn:keys.jwt.expiresIn // &lt; i dont know what is this expired for cookies or localstorage ?
          }, (err, token) =&gt; {
  
              res.redirect(keys.origin.url + "?token=" + token);
          });
  </code></pre>
  
  <p><strong>Can I indeed store everything related to the session by using sessionID (without cookies or localstorage)?</strong></p>
  
  <p>Only by doing fetch once or every page refresh and retrieving the data and then saved into redux because I use React SPA.</p>