5 ms·
Can someone explain the Cookie vs LocalStorage thing? You can access cookies from Javascript, so how is localstorage worse? Assuming an attacker can execute arb
by staticassertion 8y ago
Can someone explain the Cookie vs LocalStorage thing? You can access cookies from Javascript, so how is localstorage worse? Assuming an attacker can execute arbitrary js in the browser (the model provided by the article).
edit: Thanks for the answers - httponly, makes sense.
- nbevans 8y agoYou can't access a cookie from JavaScript if it is marked with the HttpOnly flag.
- miskin 8y agoIf you set cookie httpOnly, Javascript cannot see it. So some malicious third party library or XSS attacker cannot steal session. It can still do requests and cookies would be included, so stealing is the main difference.
- ATsch 8y ago> You can access cookies from Javascript, so how is localstorage worse? You can access it via JS only if you don't set the httpOnly flag on the cookie.
- labourcurious 8y agoThe author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.
- deathanatos 8y agohttps://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for... (It not only explains what others have said about httpOnly, but it also goes more in depth on the tradeoffs between the two.)
- deleted 8y ago[deleted]