News for hackers. Stuff that matters.

A comment on API with NestJS #3. Authenticating users with bcrypt, Passport, JWT, and cookies. Parent comment

Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by poxrud on Monday May 25, 2020 @01:19PM (#23302925)
I'm currently implementing auth with JWTs. I've settled on shortlived access tokens and long lived refresh tokens. The refresh tokens get validated against a blacklist. This way you get the best of both worlds, you minimize db access while at the same time have the ability to revoke tokens.

Another thing one must be aware of with JWTs is protecting your users against XSS and CSRF's. Make sure your shortlived token is stored on localStorage and the refresh one is stored in a cookie.

[ Parent | on HN ]
Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by zacksinclair on Monday May 25, 2020 @03:25PM (#23304047)
Why not store short lived token in a cookie as well?
[ Parent | on HN ]
Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by poxrud on Monday May 25, 2020 @04:22PM (#23304548)
Because then you can be vulnerable to csrf attack. For example if someone tricks you into clicking www.mysite.com/api/delete-account
[ Parent | on HN ]
Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by anaxag0ras on Monday May 25, 2020 @04:36PM (#23304698)
CSRF attacks can be prevented using same-site policy with cookies.
[ Parent | on HN ]
Re:API with NestJS #3. Authenticating users with bcrypt, Pas... by poxrud on Monday May 25, 2020 @05:19PM (#23305095)
That is true but it will not protect against all forms of CSRF, for example you'll be vulnerable if you have user generated content that's not sanitized properly. On the refresh_token cookie I have sameSite and httpOnly set.
[ Parent | on HN ]