3 ms·
HttpOnly makes it so XSS can't steal your token, but that won't stop XSS from using your token.
by Sohcahtoa82 4mo ago
HttpOnly makes it so XSS can't steal your token, but that won't stop XSS from using your token.
- unscaled 4mo agoTrue. But XSS stealing your token (which is always possible with localStorage) is still worse than XSS using your token. It's the principle of least privilege all over again.