Hacker News new | ask | show | jobs
by onethought 980 days ago
TLDR store session things in cookies with httponly set.

Basically nothing to do with jwts. More to do with xss

2 comments

And set the SameSite attribute to strict to prevent CSRF
SameSite=strict is weird, because it means if someone follows a link to your we application they will be treated as logged out in the first page they interact with, then logged in on any subsequent navigations they make within your site.
Wouldn't SameSite=Lax work just as well to prevent CSRF? It prevents things like malicious forms and image links from other sites.
Yes, Lax is the option when you want preventing CSRF and nothing else.

I actually don't know any use case for Strict, but it makes sense, so it's probably useful.

And None is for when you want to explicitly allow CSRF (what is useful some times).

And either way, it's best to always set that flag on sensitive cookies (not only authentication, but anything that leaks user information too), even if it's the documented default, because browsers make quite a mess of their default.

But then I need a cookie banner /s
You do NOT need a cookie banner to store a session ID or a JWT.
because these are not cookies, right?
No, because they are functional cookies, you don't need to ask for permission of those. I'm also deriving that you might be conflating the two things. JWT and cookies are two different things, but you can store JWTs in a cookie.
The law has never been about cookies themself but about tracking user and asking their consent for selling/sharing their identifying data for things unrelated to the displayed purpose of the site.
It is, in the minds of many.

And FYI it is not even a law.

You need it for local storage too if I’m not mistaken.
You don't need consent for strictly required cookies for functional purposes. Assuming the user actually logged in on your website, you don't need a banner.