4 ms·
A couple of take aways. 1. Don't put sessions in localstorage, use a cookie with the Secure and HttpOnly settings. They are then inaccessible to JavaScript. 2
by ianpurton 5y ago
A couple of take aways.
1. Don't put sessions in localstorage, use a cookie with the Secure and HttpOnly settings. They are then inaccessible to JavaScript.
2. Add a Content Security Policy to your headers. Start very tight i.e. default-src 'none'; style-src 'self'; img-src 'self'.
There's a really great PenTest checklist here https://pentestbook.six2dez.com/others/web-checklist https://pentestbook.six2dez.com/others/web-checklist So you can see it from the attackers perspective.
- blincoln 5y agoHttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript. The takeaway I'd suggest instead is that when one gets a pen test report back with a bunch of lower-severity issues, fix them instead of deciding that anything "medium" or below gets put on the backlog, because frequently a bunch of lower-severity vulns can be chained together like this to yield something much more dangerous.
- sebazzz 5y ago> HttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript. What is wrong with cookie authentication?
- paulfurtado 5y agoIt's not usable for cross-domain AJAX requests, is implicit, and it allows for drive by request attacks that must be mitigated with csrf token headers. Using token auth headers can avoid the use of csrf tokens and make your backend only require a single type of auth.