4 ms·
> At the time I knew literally nothing but I knew that was dumb as hell Why? If you're worried about XSS, remember you're already toast in a million ways - inc
by jeswin 5y ago
> At the time I knew literally nothing but I knew that was dumb as hell
Why? If you're worried about XSS, remember you're already toast in a million ways - including the ability to spoof a login/password form.
- gravlaks 5y agoOne reason is if you store refreshTokens in localStorage, a hacker's XSS attack can send the refreshToken to himself, and keep refresing the token forever (or until somebody actively invalidates the session) - and thus use the token for whatever evil purpose.