3 ms·
> Then, store the token in a secure cookie. It's way more secure than moving a token into the browser, where a dependency vulnerability could get access to it.
by throwoutway 5y ago
> Then, store the token in a secure cookie. It's way more secure than moving a token into the browser, where a dependency vulnerability could get access to it.
Cookies are still in the browser so what difference are you specifically addressing or advocating
- jensneuse 5y agoSecure, encrypted, same site, http only cookies cannot be accessed by JavaScript.
- whateveracct 5y agoSign it as well! For instance: https://github.com/gorilla/securecookie https://github.com/gorilla/securecookie Unless I'm missing something and the payload is effectively signed. Either way, I still like to have signing generically done at this level of abstraction. Then I can put whatever in there. Sometimes the encrypted payload is also signed too - maybe with a per-user secret. Now "log out everywhere" is as simple as scrambling the user's secret, thus invalidating their cookies. Simple.