3 ms·
Encrypting all sensitive information that gets stored with a public key received from server. That saves bandwidth compared to cookies, any rouge plugins/javasc
by Anunayj 6y ago
Encrypting all sensitive information that gets stored with a public key received from server. That saves bandwidth compared to cookies, any rouge plugins/javascript won't be able to decrypt the data. (and the client too won't be able to, kinda a bummer). The server will be able to decrypt it obviously since it should have the corresponding private key.
- SahAssar 6y agoAny other JS could still read the encrypted data and exfiltrate it, and use it in the same way as the "real" client since they can both see and use the same data. What you are describing is very similar to how JWT already works (at least in the JWE variant which is encrypted, not only signed). If you want to save bandwidth the easiest way is to have a separate subdomain for API requests or asset requests so you don't send the cookie with asset requests. I don't think that is worth it for 99% of sites though.