News for hackers. Stuff that matters.

A comment on Ask HN: What do you use for authentication and authorization?. Parent comment

Re:Ask HN: What do you use for authentication and authorizat... by SahAssar on Friday December 28, 2018 @05:59AM (#18776103)
> competent attackers will simply run their code from the victim's browser and session

What do you mean? JS even on the same page can't read HTTPOnly cookies. If you are assuming that the browser has been hacked then it is pretty much game over regardless of what you use.

[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by metafunctor on Saturday December 29, 2018 @03:32AM (#18782657)
We are talking about XSS, where an attacker can run their JS code on your page. If the attacker can run JS on your page, they can already do whatever your signed-in user can do. No need to read the cookie to make authenticated requests, just like your own code doesn’t need to read the cookie.
[ Parent | on HN ]