3 ms·
But any XSS would give access to your authentication token, this is why you should never store it in local storage. Cookies have the httponly flag that prevents
by jusob 7y ago
But any XSS would give access to your authentication token, this is why you should never store it in local storage. Cookies have the httponly flag that prevents javascript from accessing the cookie in case of XSS.
- paulddraper 7y agoXSS is usually really, really bad anyway. CSP plus trusted scripts...you should be working hard to prevent XSS.
- earthboundkid 7y agoIdeally, yes. In the current advertising market? No.
- paulddraper 7y agoI don't know much about advertising. Can't they be easily handled with an iframe?
- amlozano 7y agoHttpOnly doesn't really do much to stop an attacker that already has XSS. The attacker just makes the XSS perform the interactions they want directly instead of bothering to steal the cookie. James Kettle wrote a good blog post that argues that webstorage is probably a better spot for session tokens here: https://portswigger.net/blog/web-storage-the-lesser-evil-for-session-tokens https://portswigger.net/blog/web-storage-the-lesser-evil-for...