5 ms·
> HttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript. What is wrong wi
by sebazzz 5y ago
> HttpOnly doesn't make sense for most apps anymore, because so much of the logic in modern web apps happens on the client side in Javascript.
What is wrong with cookie authentication?
- paulfurtado 5y agoIt's not usable for cross-domain AJAX requests, is implicit, and it allows for drive by request attacks that must be mitigated with csrf token headers. Using token auth headers can avoid the use of csrf tokens and make your backend only require a single type of auth.