|
|
|
|
|
|
by d-z-m
980 days ago
|
|
|
> Modern web applications (so called single page applications) often utilize JSON Web tokens (JWTs) for session handling instead of cookies I had thought the main way JWTs are stored and transmitted in a web context is via Cookie/Set-Cookie? > This attack would not be possible with a cookie based session mechanism where attributes like HttpOnly would prevents injected JavaScript Code from accessing the JWTs. You can put the JWT inside the HttpOnly cookie, right? What am I missing? |
|
|
People using JS frontend frameworks to handle every single feature of the frontend, so that they have to let the cookie unprotected or store the token into a JS-only storage.