3 ms·
Secure, encrypted, same site, http only cookies cannot be accessed by JavaScript.
by jensneuse 5y ago
Secure, encrypted, same site, http only cookies cannot be accessed by JavaScript.
- whateveracct 5y agoSign it as well! For instance: https://github.com/gorilla/securecookie https://github.com/gorilla/securecookie Unless I'm missing something and the payload is effectively signed. Either way, I still like to have signing generically done at this level of abstraction. Then I can put whatever in there. Sometimes the encrypted payload is also signed too - maybe with a per-user secret. Now "log out everywhere" is as simple as scrambling the user's secret, thus invalidating their cookies. Simple.