With koras, this is no longer a problem.
You can auth on the server and still use the components interactively on the client because
the components work similarly om the client and the server. The best thing since sliced bread.
JWT auth is what happens when you don’t trust your server…
so you move the problem to the client and call it “stateless.”
Now you have:
• refresh token gymnastics
• storage debates
• expiry edge cases
• revocation hacks
All to avoid… a cookie.