News for hackers. Stuff that matters.

A comment on Stop using JSON Web Tokens for user sessions. Parent comment

Re:Stop using JSON Web Tokens for user sessions by Moneysac on Saturday November 25, 2023 @03:39PM (#38416494)
In a single page application you have to access the JWTs with JavaScript. When we use cookies to implement sessions we have attributes like HttpOnly to prevent the cookie from being referenced by JavaScript code. In this case a XSS vulnerability would not be able to simply access the cookie and take over another users session.

What I am trying to say here is that JWTs used in single page applications are dangerous because you have no layer of protection against XSS attacks.

[ Parent | on HN ]
Re:Stop using JSON Web Tokens for user sessions by seandoe on Saturday November 25, 2023 @09:07PM (#38418587)
> In a single page application you have to access the JWTs with JavaScript.

Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.

[ Parent | on HN ]