Authentication

The thing with FE based tokens is - they can't be 100% secure. No matter what you do, they can still be accessed/read in various ways. That's just the nature of FE side.

Now, what options you have? There is a couple, but two are most common:

• Local storage - while the easiest - definitely not the most secure.
• HTTPOnly secure cookie with SameSite requirement - that is probably the most recommended way nowadays.

But to be fair, the biggest thing is - not the cookie storage itself, but securing it's usage. For example - if you store it in the most secure way possible, but someone still reads it and uses it - it wasn't secure. Or if your token never expires - that's another security issue.

So for that reason, I would recommend you to rotate the token on each login (never reuse it), keep it alive for a short period of time and always check for validation. On top, you can work with keeping browser/ip information that you get - to make sure it's not used elsewhere.

That said - there is a lot of resources available for this, with various arguments for/against any method. And it depends on your use case too (since mobile apps for API work differently than SPA applications). So research here is required to find the "best fit" (mind you, not the best solution, since that seems to be opinionated) :)