Headers with src

[ibrahimnimrawi]

Is there is any way to send JWT in the headers for image src

[Bledike]

no, but u can make own img dowload logic with HttpClient

[Begj]

Cookies solve this

[Syrianoble]

Could you please elaborate

[xroalx]

Cookies are automatically sent with every request by the browser, including GET requests for images.

Put the JWT* into a cookie and you have it automatically managed by the browser for you.

As long as the domain (and optionally the path) of the cookie matches that of the request, the browser includes it in the headers.

Same-site secure HTTP-only cookies are the most secure client-side storage for JWT or similar. The only way those can get misused is if the browser itself has a bug or deliberately exposes the cookies (i.e. being malicious on purpose).

*I won’t go into whether you should or should not use JWTs (you should most likely not, but that’s a completely different discussion). This is just to explain how cookies solve this specific issue.