I don’t like the click bait title, but the conclusion is interesting.
SPAs Are Dead?
21–30 of 118 posts
Re: SPAs Are Dead?
#22Earlier quoted context omitted.
I don’t know whether you are referring to only local and session storage being feasible or not, but on can access cookies from JS as well.
Normal cookies are JS-accessible, but HTTP-only cookies should not be: "A cookie with the HttpOnly attribute is inaccessible to the JavaScript Document.cookie API; it is sent only to the server." https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#re...
Ah thanks! This is new to me. That is indeed a concern, but probably can be worked around, e.g. by proxying requests to third party domains through the same Domain.
Re: SPAs Are Dead?
#23Earlier quoted context omitted.
This is how I prefer to do it. No CORS pre-flight requests and messing with CORS settings
Seconding (thirding?) this. I'm curious, are there any SPAs that aren't done this way?
The article is referring to all the myriad other things an SPA will bring in. Analytics, feedback components, interactive galleries, notification components, header components... you can sew a site together from SaaS components that all live in different domains.
Well... you could. Harder now.
From the article:
> So are SPAs dead? Well – SPAs as in the UI/UX concept certainly not. SPAs as in “browser-based standalone applications that do cross-site authentication and API calls in the context of a modern identity and SSO architectures” – yes.
Re: SPAs Are Dead?
#24[deleted]
Re: SPAs Are Dead?
#25Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.
No, it is not. And I hope I never end up using any application developed this way. Tokens stored in those storages you mention can be read by any javascript code, even third party. That doesn't happen with http-only cookies. Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.
If your third party libraries are so poisoned that you're leaking localstorage, you've got bigger problems than just localstorage... This argument against using localstorage makes no sense
Re: SPAs Are Dead?
#26SPAs as in the UI/UX concept certainly not. SPAs as in “browser-based standalone applications that do cross-site authentication and API calls in the context of a modern identity and SSO architectures” – yes.
Has the latter ever been a definition of "SPA"? One would have thought the acronym "single page application" to have been fairly precise...
Re: SPAs Are Dead?
#27Earlier quoted context omitted.
This is how I prefer to do it. No CORS pre-flight requests and messing with CORS settings
Seconding (thirding?) this. I'm curious, are there any SPAs that aren't done this way?
Yes there are a ton. Actually it was a bit of a pain setting it up that way. I'm using Cloudflare to dynamically route to S3 or an ALB based on the path. If Cloudflare didn't have that option I would have had to roll my own solution to defeat CORS which could have added in another point of failure
Edit: I meant Cloudfront. I do that a lot
Re: SPAs Are Dead?
#28Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.
Leaking your auth tokens through XSS sucks more.
If you have an xss your problem is much bigger than leaking an ephemeral access token through localStorage
Re: SPAs Are Dead?
#29Earlier quoted context omitted.
No, it is not. And I hope I never end up using any application developed this way. Tokens stored in those storages you mention can be read by any javascript code, even third party. That doesn't happen with http-only cookies. Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.
If your third party libraries are so poisoned that you're leaking localstorage, you've got bigger problems than just localstorage... This argument against using localstorage makes no sense
Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.
Re: SPAs Are Dead?
#30Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.
No, it is not. And I hope I never end up using any application developed this way. Tokens stored in those storages you mention can be read by any javascript code, even third party. That doesn't happen with http-only cookies. Be careful with what you recommend publicly, as others might end up assuming this is fine, when it is clearly not.
Related to this I was always wondering where to store refresh tokens when using both, access token and refresh token. Reference: https://stackoverflow.com/q/57650692