11–20 of 162 posts
Earlier quoted context omitted.
That last argument you're making there is not valid in my opinion. Security is built by layers and the reason we use HttpOnly cookies is to still have protection even if malicious javascript steals a cookie.
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
Earlier quoted context omitted.
That last argument you're making there is not valid in my opinion. Security is built by layers and the reason we use HttpOnly cookies is to still have protection even if malicious javascript steals a cookie.
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
Even this article gets it wrong: CORS does not protect you in any way. It‘s a relaxation of the SOP! Thus it decreases security.
Earlier quoted context omitted.
That last argument you're making there is not valid in my opinion. Security is built by layers and the reason we use HttpOnly cookies is to still have protection even if malicious javascript steals a cookie.
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
CORS is confusing to understand because the kind of attack it protects against is confusing. CORS does not protect endpoints against malicious clients, since you can always just make the same request outside of a browser. And it doesn't protect any site from making or receiving cross-site requests, since CORS can always be disabled on the server side. CORS protect against the scenario where a malicious site tricks an…
Am I right in thinking that storing secrets/API keys in cloud functions is OK though. i.e. CF cloud workers or similar
What is missing is a guide how to replace the bad pattern bey a good one. Add a function that the user can login, create his individual API key, and store in a a secure way on his client (e.g. any credential store)
httpOnly secure same-site cookie. Even storing a session token in localStorage is not a problem if you‘re protected against xss (if your not, nothing else will protect you anyway)
The second has no value because you are either using techniques that are not vulnerable by XSS or not. “same-site” cookie is one of them.
Earlier quoted context omitted.
How does it protect the user? If there is a XSS vulnerability I can do anything in your name anyways. Stealing the cookie is not necessary.
You can do anything until I close a page. Stealing cookie might allow you to continue after that.