Re:Stop using JSON Web Tokens for user sessions
by had-rien on Saturday November 25, 2023 @06:42AM
(#38412891)
I've been exploring best practices for session storage, and it seems like using HTTP-only cookies the only secure choice.
However, I've hit a roadblock when trying to implement a login feature within an iframe, especially with Safari disabling cookie functionality in iframes. This has left me pondering alternatives for secure user authentication within iframes.
Has anyone encountered a similar challenge or found a workaround? I'd love to hear your insights and experiences!
[ Parent
| on HN ]
Re:Stop using JSON Web Tokens for user sessions
by bob1029 on Saturday November 25, 2023 @07:04AM
(#38413002)
I had a problem with cookies on iOS/safari, so we reached for the last hope: url query args.
Works flawlessly now. If you use an external identity provider, you can hypothetically avoid storing any cookies at all in first party terms. All you'd have would be 3rd party AAD tokens or whatever.
The only reason we even need first party client state is because we want to allow each user simultaneous app sessions that have lifetime decoupled from IdP semantics. This is what we store in the URL query (a guid). Sessions are still bound to user principals, so you would get yelled at if you tried to screenjack someone else's.
Re:Stop using JSON Web Tokens for user sessions
by g-b-r on Saturday November 25, 2023 @11:32AM
(#38414510)
Keep in mind that urls end up in logs, that might well not be so well protected