News for hackers. Stuff that matters.

A comment on Do You Really Know CORS?.

Re:Do You Really Know CORS? by parhamn on Wednesday October 03, 2018 @07:10PM (#18135567)
Im curious how many newer JS+API applications still use browser cookies as a means of authenticating API requests and how prevalent cookie usage still is for these types of applications?

JWT/tokens + Local/session storage + adding fetch headers seems like the best way as long as you don't run untrusted JS.

[ Parent | on HN ]
Re:Do You Really Know CORS? by anthuswilliams on Thursday October 04, 2018 @12:45AM (#18137264)
"as long as you don't run untrusted JS" is a surprisingly tough hurdle to hit, even for very experienced developers.

What is your reason for preferring JWT + localStorage for authentication and session handling? I'm genuinely curious, as httpOnly cookies strike me as better in every meaningful way.

[ Parent | on HN ]
Re:Do You Really Know CORS? by philcockfield on Wednesday October 03, 2018 @10:33PM (#18136676)
LocalStorage is so much more preferable than cookies, I agree, however as SSR ("server-side-rendering") of heavy client-side JS apps becomes more prevalent, suddenly cookies are back in business.

If the initial SSR needs some initial client-state to complete its work before sending the HTML payload, it can see the cookie, but not localStorage.

[ Parent | on HN ]