While you can just store a single JWT in a HTTP-Only Cookie the downside is that the user gets logged out once the JWT expires, meaning this solution is not really suitable for keeping alive long sessions.

Instead, a common practice is to generate an Access and Refresh Token Pair.

In short you store the access token (short-lived) in an HTTP-only cookie or in-memory, and store the refresh token (longer-lived) in a separate, secure HTTP-only cookie.

However, this involves implementing a more complex solution for your auth flow.

I found this guide if you want to delve deeper into the topic.