4 ms·
"If an attacker can read the user's localStorage" 9/10 the attacker is the user.
by donatj 8y ago
"If an attacker can read the user's localStorage"
9/10 the attacker is the user.
- franciscop 8y agoSince the topic is authentication, that is an independent concern, right? Edit: unless you mean something about making the user do something. If it's running a script, it's the same in both ways. Now, if it is about the user retrieving and sending the token, the attacker could still ask the user to manually get the session cookie or the localStorage JWT. The cookies might be protected not to be accessible from JS, but they are still in the browser.