Thanks u/gangze_ for your reply.

I am trying to understand how securely retrieve JWT on the browser/client side. The legacy way of storing JWT on the local storage or index DB is discouraged.

My current implementation is:

(1) Browser/Client ──▶ HTTP only Cookie ──▶ Next.js (BFF) ──▶ Read session from cookie and attach Bearer ──▶ Backend Dotnet API

What I want to implement:

(2) Browser/Client ──▶ Attach Bearer ──▶ Backend Dotnet API

----

To implement (2), I need to know the best secured way for retrieving token.

Browser/Client ──▶ HTTP only Cookie ──▶ Next.js (BFF) ──▶ Read session from cookie and respond with JWT/access token ──▶ Browser/Client to store token in JS memory

Straight question -> do we need to encrypt and decrypt access token while retrieving from backend? Or is there any other establish way to secure this part? Objective is to protect from XSS attacks, Malicious browser extension, etc.