Show HN: Clerk – all of user management as-a-service, not just authentication

Re:Show HN: Clerk – all of user management as-a-service, not... by braveyellowtoad on Monday February 08, 2021 @06:30PM (#26071824)

Out of curiosity, why are cookies preferred to local storage ?

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by bpicolo on Monday February 08, 2021 @07:22PM (#26072263)

As the others said - XSS. Stored XSS can still be a vulnerability with secure cookies, but locally stored tokens are a dramatically easier thing to take advantage of as an attacker, as they can just exfiltrate the token and hit your APIs with it.

For web browsers, cookie-based auth solves a ton of browser-specific problems that history has spent a long time building up answers for.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by maldini94 on Monday February 08, 2021 @07:09PM (#26072146)

XSS attacks.

Also note that the cookies should be http only and with the secure flag

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by andrewnicolalde on Monday February 08, 2021 @06:50PM (#26071998)

Any JavaScript on the same origin can read localstorage IIRC.

[ Parent | on HN ]