Can I store a JWT in a cookie?

The answer

Yes. Many applications place a signed token in an HttpOnly, Secure cookie so that page scripts cannot read it. Because browsers attach cookies automatically, you then need CSRF protections such as a suitable SameSite value and anti-forgery tokens. Remember that a signature proves integrity, not secrecy, so do not put sensitive data in the claims, and plan how to revoke tokens, since a signed token stays valid until it expires.