2 ms·
You have to attach that "JWT token" (heh) with e.g JS which makes it vulnerable to XSS, doesn't it?
by tester34 6y ago
You have to attach that "JWT token" (heh) with e.g JS which makes it vulnerable to XSS, doesn't it?
- kenniskrag 6y agoWith xss you can also inject the code. So no cookie extraction needed imho.