I have been (for quite a long time) developing apps using Angular for the frontend and PHP for the backend. I handled the security creating a JWT token that was sent from the back to the front and then stored in localStorage to keep the user logged in even if the browser was closed.

But recently I read that storing the token on localStorage was a terrible idea! Mainly because is accesible to anyone that sits on the same computer and can be read using Javascript. So I read that the proper way to go is to store it on a HttpOnly Secure cookie and send it on every API call. I changed that and made an interceptor to send it “WithCredentials”.

But the problem is the architecture of my apps. I usually develop them on a subdomain (https://app.example.com) and have the backend on another subdomain (https://api.example.com). So, the backend sets a HttpOnly Secure cookie… and is blocked because of the third-party blocking default policy on browsers nowadays…

How should I approach this? I have tried discussing it with ChatGPT, Gemini, Claude… and it was useless…

Thanks!