3 ms·

Glad you chose cookies for this versus localstorage JWT tokens. Kudos for that.

• braveyellowtoad 6y ago
  Out of curiosity, why are cookies preferred to local storage ?
  • andrewnicolalde 6y ago
    Any JavaScript on the same origin can read localstorage IIRC.
  • maldini94 6y ago
    XSS attacks. Also note that the cookies should be http only and with the secure flag
  • bpicolo 6y ago
    As the others said - XSS. Stored XSS can still be a vulnerability with secure cookies, but locally stored tokens are a dramatically easier thing to take advantage of as an attacker, as they can just exfiltrate the token and hit your APIs with it. For web browsers, cookie-based auth solves a ton of browser-specific problems that history has spent a long time building up answers for.