Stop using JSON Web Tokens for user sessions
ds-security.com
Stop using JSON Web Tokens for user sessions
1–10 of 145 posts
Re: Stop using JSON Web Tokens for user sessions
#2[deleted]
Re: Stop using JSON Web Tokens for user sessions
#3Here's a link to an old Stack Overflow question where it's stressed that JWT should be stored as cookies.
https://stackoverflow.com/questions/27067251/where-to-store-...
The Stack Overflow question is nearly a decade old. This is hardly new. This is not a JWT issue.
Re: Stop using JSON Web Tokens for user sessions
#4TLDR store session things in cookies with httponly set.
Basically nothing to do with jwts. More to do with xss
Re: Stop using JSON Web Tokens for user sessions
#5It's interesting how much of an upward hill battle it has been for me to argue that JWT tokens need to be stored in cookies rather than LocalStorage. In my latest project, the lead backend dev is convinced it is insecure to store the accessToken in a HTTPOnly cookie, and that it HAS to be stored in LocalStorage.
Re: Stop using JSON Web Tokens for user sessions
#6It's interesting how much of an upward hill battle it has been for me to argue that JWT tokens need to be stored in cookies rather than LocalStorage. In my latest project, the lead backend dev is convinced it is insecure to store the accessToken in a HTTPOnly cookie, and that it HAS to be stored in LocalStorage.
What was their argument?
Re: Stop using JSON Web Tokens for user sessions
#7Ah, here we go again
Re: Stop using JSON Web Tokens for user sessions
#8Here's a link to an old Stack Overflow question where it's stressed that JWT should be stored as cookies. https://stackoverflow.com/questions/27067251/where-to-store-... The Stack Overflow question is nearly a decade old. This is hardly new. This is not a JWT issue.
It's mind-blowing how much stigma there is around native browser features. The web has been around for a long time and there are "out of the box" solutions for many things folks sometimes try to re-invent.
Re: Stop using JSON Web Tokens for user sessions
#9It's interesting how much of an upward hill battle it has been for me to argue that JWT tokens need to be stored in cookies rather than LocalStorage. In my latest project, the lead backend dev is convinced it is insecure to store the accessToken in a HTTPOnly cookie, and that it HAS to be stored in LocalStorage.
I'm curious what were their reasons - it's hard to imagine how localStorage would be "more secure" than http only cookies.
It's not a zero-sum situation. There are risks and vulnerabilities in every approach, that's why we as web devs take advantage of multiple safeguards to ensure safety when sensitive information is to be transmitted over the wire.
Re: Stop using JSON Web Tokens for user sessions
#10It's interesting how much of an upward hill battle it has been for me to argue that JWT tokens need to be stored in cookies rather than LocalStorage. In my latest project, the lead backend dev is convinced it is insecure to store the accessToken in a HTTPOnly cookie, and that it HAS to be stored in LocalStorage.
But aren't HTTPonly coookies stored in a SQLite db, and have no password attached in Firefox or Chrome?