Securing your API: a modern alternative to CSRF tokens

Re:Securing your API: a modern alternative to CSRF tokens by mrmagooey on Wednesday June 14, 2017 @12:41AM (#14550694)

Isn't JWT a modern alternative to CSRF tokens?

[ Parent | on HN ]

Re:Securing your API: a modern alternative to CSRF tokens by vmasto on Wednesday June 14, 2017 @07:52AM (#14552046)

It's not. If you think it is you probably store JWT unsafely instead of in an httpOnly secure cookie.

[ Parent | on HN ]

Re:Securing your API: a modern alternative to CSRF tokens by hawkweed on Thursday June 15, 2017 @03:40AM (#14558576)

Why do you think storing JWT in secure cookie is only secure solution?

[ Parent | on HN ]