4 ms·

Could we just avoid cookies altogether, and store session info in local storage? Sure it takes a bit of JS to pass the data as part of a request, but at least

by osrec 7y ago

Could we just avoid cookies altogether, and store session info in local storage? Sure it takes a bit of JS to pass the data as part of a request, but at least you're not prone to CSRF issues. I'm not sure there are many use cases where I really need cookies if I have local storage and JS available.

deleted 7y ago
[deleted]
jusob 7y ago
But any XSS would give access to your authentication token, this is why you should never store it in local storage. Cookies have the httponly flag that prevents javascript from accessing the cookie in case of XSS.
- paulddraper 7y ago
  XSS is usually really, really bad anyway. CSP plus trusted scripts...you should be working hard to prevent XSS.
  - earthboundkid 7y ago
    Ideally, yes. In the current advertising market? No.
    - paulddraper 7y ago
      I don't know much about advertising. Can't they be easily handled with an iframe?
- amlozano 7y ago
  HttpOnly doesn't really do much to stop an attacker that already has XSS. The attacker just makes the XSS perform the interactions they want directly instead of bothering to steal the cookie. James Kettle wrote a good blog post that argues that webstorage is probably a better spot for session tokens here: https://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for...
Existenceblinks 7y ago
Defending CSRF is easier than defending local storage getting access by malicious javascript (thank tons of javascript dependencies)
atomwaffel 7y ago
But as you say, that would require JavaScript to be available, making it impossible to build web apps that store user state without relying on JS (well, I guess there’s HTTP Basic Auth) and breaking a large part of the internet in the process. Not everything is a client-side single-page web app.
- osrec 7y ago
  I know what you're saying, but it's 2019 and JavaScript is everywhere. I think most sites rely on at least some JavaScript to provide a reasonable experience for users. Do you have any examples of popular web apps that don't use js?
  - danShumway 7y ago
    I've been getting more aggressive about disabling Javascript by default, and for all that people complain, I've been pleasantly surprised how many sites still mostly work without it (some news sites work even better). A larger portion of the web than you might expect still respects the division between content, styling, and functionality. Hackernews and Reddit (at least the old version) are the two examples that spring to the top of my mind as sites that I sometimes log into without Javascript. Hackernews works so well that I sometimes don't realize I have Javascript turned off. A lot of forums fall into that category. I'm certainly not anti-JS, I like the language quite a bit and often stick up for it when it gets bashed on HN. But the ability to fall back on non-JS solutions to some problems is an important part of the web, and I wouldn't like to see it disappear. Particularly while we're in the middle of a fight over user-tracking. I think it's important to support graceful fallbacks, and cookies are a pretty good way of doing that.
    - speedplane 7y ago
      > I've been getting more aggressive about disabling Javascript by default What is the opposition to javascript exactly? Is it a privacy matter, you want to block all ad trackers? Do ad blocker plugins not suffice? Or are you concerned about security vulnerabilities with javascript? Or is there something else I'm not getting?
SquareWheel 7y ago
I would love to move away from cookies. They're included in every single network request which really bloats things up. By passing along data manually we could send only what is needed.
ludwigvan 7y ago
It is more work to emulate what you get for free by using cookies. You need to handle expiration etc yourself. Plus, you don’t have the protection of http only cookies if you go that route.
nathan_long 7y ago
> Could we just avoid cookies altogether, and store session info in local storage? Several possible issues there: - If the session is large, it eats space on the user's machine and bandwidth in requests - The session can't be shared across devices - Security concerns. You don't want to trust the user to tell you what their current state is - especially if it's "I have this much money in my account" and the like. Even if you encrypted the data, they could resend the same state at a later time - "oh look, I have a full wallet again!" You're much safer if all the user sends is "here's who I am" and every bit of associated information is under your control server-side.
- osrec 7y ago
  When I said session info, I meant only the session ID - I was not suggesting storing other session info locally as well :)

by osrec 7y ago

deleted 7y ago

[deleted]

jusob 7y ago

But any XSS would give access to your authentication token, this is why you should never store it in local storage. Cookies have the httponly flag that prevents javascript from accessing the cookie in case of XSS.

paulddraper 7y ago
XSS is usually really, really bad anyway. CSP plus trusted scripts...you should be working hard to prevent XSS.
- earthboundkid 7y ago
  Ideally, yes. In the current advertising market? No.
  - paulddraper 7y ago
    I don't know much about advertising. Can't they be easily handled with an iframe?
amlozano 7y ago
HttpOnly doesn't really do much to stop an attacker that already has XSS. The attacker just makes the XSS perform the interactions they want directly instead of bothering to steal the cookie. James Kettle wrote a good blog post that argues that webstorage is probably a better spot for session tokens here: https://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for...

Existenceblinks 7y ago

Defending CSRF is easier than defending local storage getting access by malicious javascript (thank tons of javascript dependencies)

atomwaffel 7y ago

But as you say, that would require JavaScript to be available, making it impossible to build web apps that store user state without relying on JS (well, I guess there’s HTTP Basic Auth) and breaking a large part of the internet in the process. Not everything is a client-side single-page web app.

osrec 7y ago
I know what you're saying, but it's 2019 and JavaScript is everywhere. I think most sites rely on at least some JavaScript to provide a reasonable experience for users. Do you have any examples of popular web apps that don't use js?
- danShumway 7y ago
  I've been getting more aggressive about disabling Javascript by default, and for all that people complain, I've been pleasantly surprised how many sites still mostly work without it (some news sites work even better). A larger portion of the web than you might expect still respects the division between content, styling, and functionality. Hackernews and Reddit (at least the old version) are the two examples that spring to the top of my mind as sites that I sometimes log into without Javascript. Hackernews works so well that I sometimes don't realize I have Javascript turned off. A lot of forums fall into that category. I'm certainly not anti-JS, I like the language quite a bit and often stick up for it when it gets bashed on HN. But the ability to fall back on non-JS solutions to some problems is an important part of the web, and I wouldn't like to see it disappear. Particularly while we're in the middle of a fight over user-tracking. I think it's important to support graceful fallbacks, and cookies are a pretty good way of doing that.
  - speedplane 7y ago
    > I've been getting more aggressive about disabling Javascript by default What is the opposition to javascript exactly? Is it a privacy matter, you want to block all ad trackers? Do ad blocker plugins not suffice? Or are you concerned about security vulnerabilities with javascript? Or is there something else I'm not getting?

SquareWheel 7y ago

I would love to move away from cookies. They're included in every single network request which really bloats things up. By passing along data manually we could send only what is needed.

ludwigvan 7y ago

It is more work to emulate what you get for free by using cookies. You need to handle expiration etc yourself. Plus, you don’t have the protection of http only cookies if you go that route.

nathan_long 7y ago

> Could we just avoid cookies altogether, and store session info in local storage? Several possible issues there: - If the session is large, it eats space on the user's machine and bandwidth in requests - The session can't be shared across devices - Security concerns. You don't want to trust the user to tell you what their current state is - especially if it's "I have this much money in my account" and the like. Even if you encrypted the data, they could resend the same state at a later time - "oh look, I have a full wallet again!" You're much safer if all the user sends is "here's who I am" and every bit of associated information is under your control server-side.

osrec 7y ago
When I said session info, I meant only the session ID - I was not suggesting storing other session info locally as well :)