Title: I’m using passport.js with a local strategy for authentication, and I’m using sessions&#x2F;cookies for keeping state and keeping the user logged in.<p>I’m not very knowledgeable in security (that’s why I’m asking here), but will using JWT (with the token stored in the cookie) to keep the user logged in  instead of sessions&#x2F;cookies make my application more secure when the passport middleware executes req.isAuthenticated? I thiiink somewhere in that call it checks cookies or jwt, depending on implementation.<p>Also, I do not plan on opening the API to other sites, so OAuth is unnecessary. Is my understanding correct?
Upvote: