News for hackers. Stuff that matters.

A comment on SPAs Are Dead?. Parent comment

Re:SPAs Are Dead? by tmpz22 on Wednesday April 07, 2021 @03:41PM (#26730039)
Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.
[ Parent | on HN ]
Re:SPAs Are Dead? by minhazm on Wednesday April 07, 2021 @03:54PM (#26730249)
That also applies to cookies. Users can run any browser or script to access your site and do whatever they want with the cookies.
[ Parent | on HN ]
Re:SPAs Are Dead? by gigaftp on Wednesday April 07, 2021 @04:13PM (#26730528)
In the context of a compliant web browser you can set a cookie as http only as to disallow access it via Js.
[ Parent | on HN ]
Re:SPAs Are Dead? by Jenk on Wednesday April 07, 2021 @04:20PM (#26730623)
Not for http-only cookies it doesn't.
[ Parent | on HN ]
Re:SPAs Are Dead? by fractionalhare on Wednesday April 07, 2021 @04:55PM (#26731125)
No they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
[ Parent | on HN ]