SPAs Are Dead? • Hacker News Board

Re: SPAs Are Dead?

#11

Post by true_religion » Wed, Apr 07, 2021, 7:05 PM UTC

beckingz wrote: post #7

yitianjian wrote: post #5

Earlier quoted context omitted.

Seconding (thirding?) this. I'm curious, are there any SPAs that aren't done this way?

app.example.com vs api.example.com ?

Sure I've done that but only for SPAs that are totally anonymous, and deploy the api.example.com behind a CDN cache.

Re: SPAs Are Dead?

#12

Post by kadfak » Wed, Apr 07, 2021, 7:05 PM UTC

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

Leaking your auth tokens through XSS sucks more.

Re: SPAs Are Dead?

#13

Post by midrus » Wed, Apr 07, 2021, 7:06 PM UTC

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

No, it is not. And I hope I never end up using any application developed this way.

Tokens stored in those storages you mention can be read by any javascript code, even third party.

That doesn't happen with http-only cookies.

Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.

Re: SPAs Are Dead?

#14

Post by leipert » Wed, Apr 07, 2021, 7:08 PM UTC

kadfak wrote: post #12

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

Leaking your auth tokens through XSS sucks more.

I don’t know whether you are referring to only local and session storage being feasible or not, but on can access cookies from JS as well.

Re: SPAs Are Dead?

#15

Post by leipert » Wed, Apr 07, 2021, 7:10 PM UTC

kostarelo wrote: post #10

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

By interface you mean.. the HTTP protocol? At least they can be scoped on the domain level. Browser storage can't.

Local storage and Session Storage are scoped per origin as well: https://developer.mozilla.org/en-US/docs/Glossary/Origin

Re: SPAs Are Dead?

#16

Post by AlbinoDrought » Wed, Apr 07, 2021, 7:11 PM UTC

leipert wrote: post #14

kadfak wrote: post #12

Earlier quoted context omitted.

Leaking your auth tokens through XSS sucks more.

I don’t know whether you are referring to only local and session storage being feasible or not, but on can access cookies from JS as well.

Normal cookies are JS-accessible, but HTTP-only cookies should not be: "A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server."

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#re...

Re: SPAs Are Dead?

#17

Post by jakelazaroff » Wed, Apr 07, 2021, 7:11 PM UTC

pier25 wrote: post #9

I prefer using cookies, but most SPAs actually use JWTs.

Cookies and JWTs are not alternatives to each other. You can store a JWT in a cookie.

Re: SPAs Are Dead?

#18

Post by notsureaboutpg » Wed, Apr 07, 2021, 7:13 PM UTC

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

localStorage doesn't work in many browsers' private modes, so no... it's not

Re: SPAs Are Dead?

#19

Post by fractionalhare » Wed, Apr 07, 2021, 7:13 PM UTC

leipert wrote: post #14

kadfak wrote: post #12

Earlier quoted context omitted.

Leaking your auth tokens through XSS sucks more.

I don’t know whether you are referring to only local and session storage being feasible or not, but on can access cookies from JS as well.

Which is why you use domain scoping, httpOnly and Secure cookie flags so they can only be read by matching hosts (with greater granularity than same-origin policy) over HTTPS and can’t be read by JavaScript. The Web Storage API does not offer these protections.

Re: SPAs Are Dead?

#20

Post by rory » Wed, Apr 07, 2021, 7:15 PM UTC

The general trend here seems that browser security improvements are more likely to kill core-function-of-your-app-as-a-service type software products, rather than SPAs in general or in particular.