4 ms·

"You may be tempted to use JWT instead of a database of session cookies. Please don't. Here's why: http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.png

by jvehent 10y ago

"You may be tempted to use JWT instead of a database of session cookies. Please don't. Here's why: http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.png http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.pn... " source: https://twitter.com/j4cob/status/831286673644216320 https://twitter.com/j4cob/status/831286673644216320

chncdcksn 10y ago
I may be wrong, but I don't think JavaScripts from a CDN can access the same localStorage as some JavaScript from another origin. (Source: "Cross-origin data storage access" https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...)
- tprynn 10y ago
  You are wrong. The 'origin' of a script is the domain which loads it, not the domain where it is hosted. (Those can be the same, though.)
  - chncdcksn 10y ago
    TIL. Thanks!