4 ms·
CSRF is mitigated by using the samesite cookie flag. XSS is mitigated by httponly, except where XSS makes legitimate requests to domains specified by the cookie
by beardedwizard 8y ago
CSRF is mitigated by using the samesite cookie flag. XSS is mitigated by httponly, except where XSS makes legitimate requests to domains specified by the cookie.
This article describes some of the most vulnerable ways to use a JWT in 2019, but please let's stop talking about none algorithms.
- fenwick67 8y agosamesite doesn't appear to work in Safari, IE or Edge sadly. EDIT: apparently it's a bit more complicated than that: IE11 on windows 7 doesn't support it, and Safari < iOS12 doesn't support it. Still seems like a significant-enough chunk that you can't rely on it. https://caniuse.com/#search=samesite https://caniuse.com/#search=samesite
- beardedwizard 8y agoConsidering the alternative is local storage, and I can include traditional csrf tokens, it still feels like a partially supported samesite flag with httponly is a solid defense against xss and csrf and doesn't lead to a road of dangerous tech debt.