--- title: Session Cookies or Bearer Tokens? | daily.dev description: A real-world walkthrough of migrating an AdonisJS SPA from bearer tokens stored in localStorage to the session guard with httpOnly cookies, covering the... canonical: https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Session Cookies or Bearer Tokens? | daily.dev og:description: A real-world walkthrough of migrating an AdonisJS SPA from bearer tokens stored in localStorage to the session guard with httpOnly cookies, covering the... og:url: https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm og:image: https://api.daily.dev/og/posts/cf0PtuYHM.png og:image:alt: Session Cookies or Bearer Tokens? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Session Cookies or Bearer Tokens? **[The Miners](https://daily.dev/sources/miners)** · 12 min read · 0 upvotes · 1 comments ## Summary A real-world walkthrough of migrating an AdonisJS SPA from bearer tokens stored in localStorage to the session guard with httpOnly cookies, covering the security trade-offs (XSS token theft vs CSRF exposure), cross-origin vs cross-site cookie behavior, CORS and CSRF configuration specifics in Adonis, and a zero-downtime cutover strategy using dual guards (session + token) so existing users weren't logged out during the switch. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Should I use session cookies or bearer tokens for a React SPA served from the same domain as my API? Session cookies with httpOnly are the better fit when the frontend and API share the same top-level domain, because the session ID is invisible to JavaScript and immune to token theft via XSS. Bearer tokens remain the right choice for mobile apps, CLI tools, server-to-server integrations, or a frontend hosted on a genuinely different site, since cookies become third-party cookies in that case and are subject to browser policy. _Developers weighing auth architecture trade-offs can find real migration experiences like this one on daily.dev._ ### How do you migrate an app from access tokens to session-based auth in AdonisJS without logging out all existing users? Register both the session and token guards on the same routes using middleware.auth({ guards: ['web', 'api'] }), so authentication succeeds if either guard passes. New logins issue sessions while existing token holders keep working unchanged. After giving users enough time to re-authenticate naturally (one week in this case), the old access_tokens table can be dropped safely. _Teams planning a zero-downtime auth cutover can track practical patterns like this through daily.dev._ ### What AdonisJS session cookie settings matter most for security when switching from token auth? Three settings matter: httpOnly true keeps the session ID out of reach of JavaScript so XSS can't exfiltrate it, secure defaults to app.inProduction so HTTPS is enforced only where needed, and sameSite lax blocks classic cross-site form POST CSRF attacks while still allowing normal navigation. Pairing sameSite lax with @adonisjs/shield's enableXsrfCookie covers the remaining CSRF gap cookies introduce. _Developers configuring cookie-based auth can compare framework-specific defaults and gotchas on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@andychiare** · 0 upvotes > Storing bearer tokens in localStorage is a bad idea. > > Read [this article](https://dly.to/9RmzTR57ovV) for a more general clarification about using cookies or tokens to implement authenticated sessions. ## Similar posts on daily.dev - [What's the best way to do authentication in modern applications](https://daily.dev/posts/what-s-the-best-way-to-do-authentication-in-modern-applications-7iho9es5q) · Neciu Dan · 25 upvotes · 1 comments - [A Practical Guide to Secure Authentication for Developers](https://daily.dev/posts/a-practical-guide-to-secure-authentication-for-developers-p5rufwxgq) · SitePoint · 0 upvotes · 0 comments - [Your Logout Button Is Lying: ASP.NET Session Security Done Right — Daily DevOps & .NET](https://daily.dev/posts/your-logout-button-is-lying-asp-net-session-security-done-right-daily-devops-net-swu9n2jai) · We Are .NET · 1 upvotes · 0 comments - [CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation \[Full Handbook\]](https://daily.dev/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-full-handbook--4km8mrcii) · freeCodeCamp · 17 upvotes · 4 comments - [Auth Mastery Part 2: Sessions, Cookies, and Staying Authenticated](https://daily.dev/posts/auth-mastery-part-2-sessions-cookies-and-staying-authenticated-zk5kkxcot) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#adonisjs](https://daily.dev/tags/adonisjs) [View this post on daily.dev](https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Session Cookies or Bearer Tokens?","url":"https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm"},"datePublished":"2026-10-07T12:31:10.362Z","dateModified":"2026-10-07T12:31:37.316Z","description":"A real-world walkthrough of migrating an AdonisJS SPA from bearer tokens stored in localStorage to the session guard with httpOnly cookies, covering the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/343be1d68e3ac80e2621d71de8af7dbc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/343be1d68e3ac80e2621d71de8af7dbc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Miners","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Miners","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8cf42b495e314084b9e31eb135ff5d23","url":"https://daily.dev/sources/miners"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,authentication,adonisjs","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Miners","item":"https://daily.dev/sources/miners"},{"@type":"ListItem","position":3,"name":"Session Cookies or Bearer Tokens?"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm","comment":[{"@type":"Comment","text":"Storing bearer tokens in localStorage is a bad idea.\nRead this article for a more general clarification about using cookies or tokens to implement authenticated sessions.","datePublished":"2026-10-08T06:57:08.152Z","url":"https://daily.dev/posts/cf0PtuYHM#c-1hgZYWABQ","author":{"@type":"Person","name":"Andrea Chiarelli","url":"https://daily.dev/andychiare","image":"https://avatars.githubusercontent.com/u/25705235?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/session-cookies-or-bearer-tokens--cf0ptuyhm#faq","mainEntity":[{"@type":"Question","name":"Should I use session cookies or bearer tokens for a React SPA served from the same domain as my API?","acceptedAnswer":{"@type":"Answer","text":"Session cookies with httpOnly are the better fit when the frontend and API share the same top-level domain, because the session ID is invisible to JavaScript and immune to token theft via XSS. Bearer tokens remain the right choice for mobile apps, CLI tools, server-to-server integrations, or a frontend hosted on a genuinely different site, since cookies become third-party cookies in that case and are subject to browser policy. Developers weighing auth architecture trade-offs can find real migration experiences like this one on daily.dev."}},{"@type":"Question","name":"How do you migrate an app from access tokens to session-based auth in AdonisJS without logging out all existing users?","acceptedAnswer":{"@type":"Answer","text":"Register both the session and token guards on the same routes using middleware.auth({ guards: ['web', 'api'] }), so authentication succeeds if either guard passes. New logins issue sessions while existing token holders keep working unchanged. After giving users enough time to re-authenticate naturally (one week in this case), the old access_tokens table can be dropped safely. Teams planning a zero-downtime auth cutover can track practical patterns like this through daily.dev."}},{"@type":"Question","name":"What AdonisJS session cookie settings matter most for security when switching from token auth?","acceptedAnswer":{"@type":"Answer","text":"Three settings matter: httpOnly true keeps the session ID out of reach of JavaScript so XSS can't exfiltrate it, secure defaults to app.inProduction so HTTPS is enforced only where needed, and sameSite lax blocks classic cross-site form POST CSRF attacks while still allowing normal navigation. Pairing sameSite lax with @adonisjs/shield's enableXsrfCookie covers the remaining CSRF gap cookies introduce. Developers configuring cookie-based auth can compare framework-specific defaults and gotchas on daily.dev."}}]} ```