3 ms·
How would you use the Authorization header to implement server side session data?
by baggy_trough 2y ago
How would you use the Authorization header to implement server side session data?
- seandoe 2y agoI think they mean storing an identifier in local or session storage and then sending it in the header.
- baggy_trough 2y agoIt doesn't work with basic multi page sites though.
- seandoe 2y agoOh right, strictly for spas.
- bvrmn 2y agoIdentifier in local storage could be stolen by 3rd party JavaScript. Anybody who wants to use local storage for sensitive information should read why there is a httpOnly cookie attribute.
- IgorPartola 2y agoIf you are running third party JS on your site they can just make requests to your server now. Once JS is loaded it is running in the context of your domain. No they can’t do it once the user closes the browser but third party JS is XSS in action. And I am not suggesting using local storage for it. I am suggesting adding browser support for standard/generic login UI. Basically think basic auth, just not so basic.
- bvrmn 2y ago> Basically think basic auth, just not so basic It's like technobros trying to invent an inferior train with each pod iteration.
- magicalhippo 2y agoNot a web dev. So do I understand it correctly that it's not so much the server side of this that's the issue, after all the Authorization header contains a nice token, but rather how to safely store the token client side without using cookies?