4 ms·
It's a shame because local storage and friends aren't quite as secure (no way to block all JS from accessing it like you can with cookies).
by candiddevmike 6y ago
It's a shame because local storage and friends aren't quite as secure (no way to block all JS from accessing it like you can with cookies).
- gruez 6y agoIs this really an issue? If the attacker has XSS on your site you're already screwed because they can manipulate the DOM to simulate user actions.
- staticassertion 6y agoIt means they can't exfiltrate the cookie, which I think is a pretty nice win, even if they can still perform requests to the domain with that cookie. For one thing it means they're locked to my session.
- isbvhodnvemrwvn 6y agoHow would they steal HTTP-only cookies this way?
- minitech 6y agoThey wouldn’t steal the cookie, they’d just have the script send the requests as the user directly.
- mvolfik 6y agoWhat would be the point of localstorage if JS couldn't access it? Cookies can be set and get via http headers, but is localstorage available by other means than JS?
- ficklepickle 6y agoNo, it is only accessible from JS. Parent comment does not make sense. By that logic, we should turn off our computers to improve security.