title: Where should I store my JWT token and what does httpOnly mean for a cookie?
body: <p>I read documentation about auth.
  I work on Nuxt project and my server returns a cookie <code>HtppOnly</code></p>
  <p><em>My questions :</em></p>
  <p>A lot of confusion about the storing of the JWT token, some do not recommend using the <code>localStroage</code>
  I also read we can copy the token directly in the header for the next requests, but I don't find examples.
  Also when a cookie is <code>HttpOnly</code>, how we can use it because is not accessible for JavaScript ?</p>
  <pre class="lang-js prettyprint-override"><code>// https://github.com/FormidableLabs/urql/tree/main/exchanges/auth#quick-start-guide
  if (result.data?.refreshLogin) {
    // save the new tokens in storage for next restart
    localStorage.setItem('token', result.data.refreshLogin.token);
    localStorage.setItem('refreshToken', result.data.refreshLogin.refreshToken);
    //...
  }
  </code></pre>
  <p><em>Ressources :</em></p>
  <ul>
  <li>nuxt/auth =&gt; <a href="https://www.npmjs.com/package/@nuxtjs/auth-next" rel="nofollow noreferrer">https://www.npmjs.com/package/@nuxtjs/auth-next</a></li>
  <li>urql/auth =&gt; <a href="https://www.npmjs.com/package/@urql/exchange-auth" rel="nofollow noreferrer">https://www.npmjs.com/package/@urql/exchange-auth</a></li>
  <li><a href="https://formidable.com/open-source/urql/docs/advanced/authentication/" rel="nofollow noreferrer">https://formidable.com/open-source/urql/docs/advanced/authentication/</a></li>
  <li><a href="https://formidable.com/open-source/urql/docs/api/auth-exchange/#options" rel="nofollow noreferrer">https://formidable.com/open-source/urql/docs/api/auth-exchange/#options</a></li>
  <li><a href="https://github.com/FormidableLabs/urql/tree/main/exchanges/auth#quick-start-guide" rel="nofollow noreferrer">https://github.com/FormidableLabs/urql/tree/main/exchanges/auth#quick-start-guide</a></li>
  <li><a href="https://blog.logrocket.com/jwt-authentication-best-practices/" rel="nofollow noreferrer">https://blog.logrocket.com/jwt-authentication-best-practices/</a></li>
  <li><a href="https://www.howtographql.com/react-urql/5-authentication/" rel="nofollow noreferrer">https://www.howtographql.com/react-urql/5-authentication/</a></li>
  </ul>