News for hackers. Stuff that matters.

A comment on JSON Web Tokens vs. Sessions. Parent comment

Re:JSON Web Tokens vs. Sessions by hharnisch on Saturday June 18, 2016 @02:17PM (#11929878)
On another note I've been working on a service that generates expirable/refreshable JWTs. Its a good way to start trying them out https://github.com/hharnisc/auth-service
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by joepie91_ on Saturday June 18, 2016 @05:52PM (#11930776)
Better remove that again. It is extremely dangerous to store any kind of credential in Local Storage. Cookies are the (only) correct place for storing credentials.
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by areed on Saturday June 18, 2016 @09:41PM (#11931478)
Because you can set Secure and HttpOnly flags on cookies? This merely brings them up to the same level of security you get with Local Storage. http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by pags on Sunday June 19, 2016 @10:24AM (#11933053)
What is a "level" of security? If I'm able to inject arbitrary code into your page, with it I can access your local storage data, but I can't access your "http only" cookies - so there's at least some "level" of difference.
[ Parent | on HN ]
Re:JSON Web Tokens vs. Sessions by garfij on Sunday June 19, 2016 @05:05PM (#11934671)
If you're at the point where someone can inject random code into your site, you've already lost and have so many more problems than access to localStorage.
[ Parent | on HN ]