4 ms·
Well how about that; I had no idea there was a specific standard for this type of thing nor did I realize the client could specifically request a type of algori
by BinaryIdiot 10y ago
Well how about that; I had no idea there was a specific standard for this type of thing nor did I realize the client could specifically request a type of algorithm to be used. That seems incredibly short sighted; why wouldn't you let the server handle that and make the algorithm completely transparent?
> Just use cookies over HTTPS.
Maybe it's because of my experience working in environments where cookies were disabled but I just try to avoid them where possible nowadays for my authentication handling. Instead of storing the equivalent of a session / token id in a cookie I just store it in sessionStorage and include that in requests.
- andy_ppp 10y agoYes, this prevents CSRF without tokens too.
- joepie91_ 10y ago... and causes another security issue in the process, namely the ability to steal session credentials after an XSS attack. Trading in one security issue for another makes no sense. Just implement the correct mitigation against CSRF attacks; namely, CSRF tokens.
- andy_ppp 10y agoYes but you can now concentrate make yourself XSS proof right; with an XSS you can still get someones cookies... unless you are talking HttpOnly. But we are probably talking single page webapps here anyway.
- CiPHPerCoder 10y ago> unless you are talking HttpOnly Which is precisely what the blog post that was hyperlinked in the sentence you were responding to was advocating.
- andy_ppp 10y agoIf there are no XSS attacks against ReactJS then both ways protect me from both CSRF and XSS right? If you can show ReactJS XSS then I may need to reconsider.