News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016).

Re:Stop using JWT for sessions (2016) by staticassertion on Thursday November 01, 2018 @10:36AM (#18354238)
Can someone explain the Cookie vs LocalStorage thing? You can access cookies from Javascript, so how is localstorage worse? Assuming an attacker can execute arbitrary js in the browser (the model provided by the article).

edit: Thanks for the answers - httponly, makes sense.

[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by miskin on Thursday November 01, 2018 @10:43AM (#18354316)
If you set cookie httpOnly, Javascript cannot see it. So some malicious third party library or XSS attacker cannot steal session. It can still do requests and cookies would be included, so stealing is the main difference.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by deathanatos on Thursday November 01, 2018 @10:51AM (#18354400)
https://portswigger.net/blog/web-storage-the-lesser-evil-for...

(It not only explains what others have said about httpOnly, but it also goes more in depth on the tradeoffs between the two.)

[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by labourcurious on Thursday November 01, 2018 @10:48AM (#18354376)
The author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by akarambir on Thursday November 01, 2018 @11:29AM (#18354860)
But is it still sent automatically on ajax requests by browsers?
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by SahAssar on Thursday November 01, 2018 @03:01PM (#18357269)
Yes.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by ATsch on Thursday November 01, 2018 @10:43AM (#18354319)
> You can access cookies from Javascript, so how is localstorage worse?

You can access it via JS only if you don't set the httpOnly flag on the cookie.

[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by nbevans on Thursday November 01, 2018 @10:42AM (#18354305)
You can't access a cookie from JavaScript if it is marked with the HttpOnly flag.
[ Parent | on HN ]