Storing Wave sessions with browser extension
I am building a browser extension to communicate with my Wave API from. 3rd party site. I am discovering that stateless JWT might not be the best way to do this without having the user log in each session, although feel free to correct me if I’m wrong. What is the best and safest way to allow my browser extension to save the users session?
Hey there! 👋
Not an expert in web browser extensions, but based on discussions like this one on Stack Overflow, the general recommendation is to use OAuth 2.0 for authentication.
Storing JWTs in local storage or directly in the extension isn’t ideal because it makes them vulnerable to theft. Instead, consider using Chrome’s identity API or securely storing tokens using the chrome.storage API.
That way, you avoid passing sensitive credentials directly and keep things more secure!
Hope this helps!
Another option I saw that might be more secure is using httpOnly cookies. I noticed when using Insomnia for testing the API that sometimes an httpOnly cookie is set. At what point is that generated and set for the user? On initial login/authentication? It's hard to tell in Insomnia. Does that mean subsequent requests to my API endpoints without a JWT token are already authenticated? Does this method require manual reauthentication with a refresh token? Will this work with my browser extension?
As per the docs here, the default API authentication is stateless JWT, meaning there’s no session stored for the user—each request needs a valid JWT token. So, httpOnly cookies won’t work out of the box for keeping users authenticated like they would in a stateful Sanctum setup.
If you want session-based auth (cookies instead of JWTs), you'd need to integrate Sanctum yourself. Otherwise, your best bet is refresh tokens or OAuth 2.0 for long-term authentication.
Will this work with my browser extension?
Well, that depends on how you've built it. If your extension sends requests with a JWT, it should work fine. If you're relying on session cookies, Wave won’t handle that by default. So, it’s either stick with JWTs or modify Wave to support Sanctum if you want session-based auth.
So it seems like if I want session-based auth with my browser extension then I need Sanctum, since there isn't really a safe way to use JWT with sessions. Do you have any advice for integrating Sanctum with Wave or should I just follow standard Sanctum installation as Laravel recommends? I've never used it before.