News for hackers. Stuff that matters.

A comment on Securing your API: a modern alternative to CSRF tokens. Parent comment

Re:Securing your API: a modern alternative to CSRF tokens by vmasto on Wednesday June 14, 2017 @07:52AM (#14552046)
It's not. If you think it is you probably store JWT unsafely instead of in an httpOnly secure cookie.
[ Parent | on HN ]
Re:Securing your API: a modern alternative to CSRF tokens by hawkweed on Thursday June 15, 2017 @03:40AM (#14558576)
Why do you think storing JWT in secure cookie is only secure solution?
[ Parent | on HN ]