News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by labourcurious on Thursday November 01, 2018 @10:48AM (#18354376)
The author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by akarambir on Thursday November 01, 2018 @11:29AM (#18354860)
But is it still sent automatically on ajax requests by browsers?
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by SahAssar on Thursday November 01, 2018 @03:01PM (#18357269)
Yes.
[ Parent | on HN ]