So I’ve been interested in SPAs as of recently, and the one that seems most interesting to me is Blazor WASM.

The idea was to create an API which generates a JWT token and sends it back on a successful login as a httpCookie (because apparently sending it back in the response and storing it in localStorage is the worst thing in the world because of security reasons (XSS) )

So I decided to setup a project, along with a Web API and I went ahead and made a Register/Login page.
When the User logs in, the API sends a httpCookie back containing a JWT token from the endpoint if it was a successful login.

[AllowAnonymous]
[HttpPost("Login")]
public IActionResult Login([FromBody] AccountLoginModel model)
{
    if (!ModelState.IsValid) return BadRequest(ModelState);
    var user = Authenticate(model);
    if (user == null)
        return NotFound();
    var token = GenerateToken(user);
    
    // Set the token in a secure HttpOnly cookie
     HttpContext.Response.Cookies.Append(
         "access_token", 
         token, 
         new CookieOptions 
         {
             HttpOnly = true,
             Secure = false,
             SameSite = SameSiteMode.None,
             Expires = DateTimeOffset.UtcNow.AddMinutes(5)
         });
    return Ok();
}

I noticed that the cookie wouldn’t appear in the devtools so I started Googling and came across a page which stated something along the lines of “since Blazor WASM is a client app, it can’t store a httpCookie” or something like that.

Which led me down a rabbit hole of trying to find a good way of setting up authentication and authorization.

It seems to me that every solution out there is overly complex and requires an insane amount of work to setup.

Should I just store it in localStorage and hope for the best or is the only viable option to go though the swamp also known as setting up basic auth another way?

I’ve tried googling to find a solution and it seems as if using a JWT with cookies isn’t viable with Blazor WASM, but I’m not sure.