4 ms·
Hi dubcanada, Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next f
by colinclerk 6y ago
Hi dubcanada,
Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next few weeks - but let me try to hit some of the most important points:
* Session management is handled with secure, httpOnly cookies. We have you set a CNAME in production so we can set cookies in a first-party context (SameSite=Lax).
* Cookies are scoped only to domains that require authentication data. If your backend is on api.example.com and you're running hosted Wordpress blog on blog.example.com, Wordpress won't receive your session cookies.
* Passwords are bcrypted
* All frontend-facing endpoints have CSRF protection enabled
Please let us know if there is anything specific we can help clarify. We've gotten into the nitty gritty so there's a lot to document, and it would be great to understand what areas to surface most prominently.
- itisit 6y agoSOC 2?
- colinclerk 6y agoNot yet. We plan to pursue SOC 2 as we build out Organizations, since it's a clear requirement in a B2B context.
- itisit 6y agoAnd B2C. You really ought to provide more transparency around your current security practices on your site. I do not see why someone should implicitly trust your service without any assurances, guarantees, descriptions, whitepapers, etc. Here's a good reference: https://trust.okta.com https://trust.okta.com
- bpicolo 6y agoGlad you chose cookies for this versus localstorage JWT tokens. Kudos for that.
- braveyellowtoad 6y agoOut of curiosity, why are cookies preferred to local storage ?
- andrewnicolalde 6y agoAny JavaScript on the same origin can read localstorage IIRC.
- maldini94 6y agoXSS attacks. Also note that the cookies should be http only and with the secure flag
- bpicolo 6y agoAs the others said - XSS. Stored XSS can still be a vulnerability with secure cookies, but locally stored tokens are a dramatically easier thing to take advantage of as an attacker, as they can just exfiltrate the token and hit your APIs with it. For web browsers, cookie-based auth solves a ton of browser-specific problems that history has spent a long time building up answers for.
- e-clinton 6y agoBcrypt should be replaced by Argon2
- robertlagrant 6y agoYour HIPAA status will be important for the increasing number of health related apps out there that would probably use a service like this.