security - Using JWT instead of Cookie on SSL enabled site -

instead of using cookie i'm using jwt token gets send every request. every request post request token not saved in browser's history.

it's single-page app.

the token looks like:

{     userid: 12345678,     expires: <unix timestamp>,     otherinfo: <something> } 

everything ssl secured. token created on server when user logs on.

would way replace cookie or see flaws?

no, not solution. using cookies (with httponly flag) cross-request persistence not optional - it's way safely store session credentials, in such way on-page javascript code cannot access directly.

this essential prevent eg. session stealing in xss attack, ensuring scripts cannot access credentials, can still used in requests server.

your use of jwt doesn't seem solve problem, either - why can't use session cookies using existing session implementation? kind of thing precisely they're made for.