News for hackers. Stuff that matters.

A comment on Ask HN: Go-to web stack today?. Parent comment

Re:Ask HN: Go-to web stack today? by IloveHN84 on Saturday January 05, 2019 @06:07AM (#18831070)
Cookies over JWT favours browser fingerprinting. Thanks but no. Cookies should be always avoided and tokens should be used instead
[ Parent | on HN ]
Re:Ask HN: Go-to web stack today? by jteppinette on Saturday January 05, 2019 @04:30PM (#18834388)
This is bad advice. Cookies should almost always be used in browser session management. This is due to the built-in security advantages that browsers give cookies e.g. HTTP Only. Even if your main auth strategy is using tokens, you should support a cookie wrapper for browser based clients. This is one of the main ways to decrease the attack surface area of XSS vulnerabilities.
[ Parent | on HN ]