reactjs - How to manage authentication on a Django-React webapp?

Question

I'm an undergrad student and am thinking of creating a webapp of the following structure: A React frontend hosted on Firebase that converses with a Django-API backend hosted on Heroku and uses MongoDB/Firebase Storage as database (MongoDB for now).

This app requires a user to log in and then perform some actions (for example like Twitter). I'm handling login using this method. The login is working smoothly. However the problems arise when I want login state to persist across sessions.

One way I could come up with was storing the token as a cookie/in LocalStorage and sending that to the Django API every time an action is performed. But that seems to be vulnerable to XSS.

Is there a safer way to do this or should I drop the session persistence altogether?

标签： reactjsdjangoauthenticationcookiesxss