5 ms·

JWTs can be read by every script you add to your site, making XSS attacks easier. A cookie with the HttpOnly flag prevents this. I also found cookies easier to

by m3nu 8y ago

JWTs can be read by every script you add to your site, making XSS attacks easier. A cookie with the HttpOnly flag prevents this. I also found cookies easier to use, since the browser handles them and you don't need to attach headers to each request. Any other important concerns or which way is recommended currently?

deathanatos 8y ago
> JWTs can be read by every script you add to your site, making XSS attacks easier. A cookie with the HttpOnly flag prevents this. You're confusing JWTs (a standardized token / means of representing claims) and JavaScript localStorage (a storage which can be read by scripts, partitioned by origin). The two are completely orthogonal; you could store a JWT in a cookie, if you wanted to. > JWTs [… make] XSS attacks easier. I also found cookies easier to use, since the browser handles them and you don't need to attach headers to each request. The browser handling them automatically means you need to think about CSRF, which I think largely negates the benefits. If your site is vulnerable to XSS, a cookie won't save you; the XSS attacker just makes the necessary authenticated request using an AJAX. My current favorite writeup on this is https://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for...
- beardedwizard 8y ago
  CSRF is mitigated by using the samesite cookie flag. XSS is mitigated by httponly, except where XSS makes legitimate requests to domains specified by the cookie. This article describes some of the most vulnerable ways to use a JWT in 2019, but please let's stop talking about none algorithms.
  - fenwick67 8y ago
    samesite doesn't appear to work in Safari, IE or Edge sadly. EDIT: apparently it's a bit more complicated than that: IE11 on windows 7 doesn't support it, and Safari < iOS12 doesn't support it. Still seems like a significant-enough chunk that you can't rely on it. https://caniuse.com/#search=samesite https://caniuse.com/#search=samesite
    - beardedwizard 8y ago
      Considering the alternative is local storage, and I can include traditional csrf tokens, it still feels like a partially supported samesite flag with httponly is a solid defense against xss and csrf and doesn't lead to a road of dangerous tech debt.
- jordache 8y ago
  > you could store a JWT in a cookie, if you wanted to. Huh? If it's an HTTPOnly cookie, how would you then insert the JWT token into the auth header?
  - thosakwe 8y ago
    If you’re using a cookie to store the JWT, you don’t really need to check the auth header.
    - jordache 8y ago
      if you're wrapping the JWT in a cookie, then it's effectively a session cookie. In that case, the client side difference between JWT and session cookies are effectively moot.

by m3nu 8y ago

deathanatos 8y ago

> JWTs can be read by every script you add to your site, making XSS attacks easier. A cookie with the HttpOnly flag prevents this. You're confusing JWTs (a standardized token / means of representing claims) and JavaScript localStorage (a storage which can be read by scripts, partitioned by origin). The two are completely orthogonal; you could store a JWT in a cookie, if you wanted to. > JWTs [… make] XSS attacks easier. I also found cookies easier to use, since the browser handles them and you don't need to attach headers to each request. The browser handling them automatically means you need to think about CSRF, which I think largely negates the benefits. If your site is vulnerable to XSS, a cookie won't save you; the XSS attacker just makes the necessary authenticated request using an AJAX. My current favorite writeup on this is https://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for...

beardedwizard 8y ago
CSRF is mitigated by using the samesite cookie flag. XSS is mitigated by httponly, except where XSS makes legitimate requests to domains specified by the cookie. This article describes some of the most vulnerable ways to use a JWT in 2019, but please let's stop talking about none algorithms.
- fenwick67 8y ago
  samesite doesn't appear to work in Safari, IE or Edge sadly. EDIT: apparently it's a bit more complicated than that: IE11 on windows 7 doesn't support it, and Safari < iOS12 doesn't support it. Still seems like a significant-enough chunk that you can't rely on it. https://caniuse.com/#search=samesite https://caniuse.com/#search=samesite
  - beardedwizard 8y ago
    Considering the alternative is local storage, and I can include traditional csrf tokens, it still feels like a partially supported samesite flag with httponly is a solid defense against xss and csrf and doesn't lead to a road of dangerous tech debt.
jordache 8y ago
> you could store a JWT in a cookie, if you wanted to. Huh? If it's an HTTPOnly cookie, how would you then insert the JWT token into the auth header?
- thosakwe 8y ago
  If you’re using a cookie to store the JWT, you don’t really need to check the auth header.
  - jordache 8y ago
    if you're wrapping the JWT in a cookie, then it's effectively a session cookie. In that case, the client side difference between JWT and session cookies are effectively moot.