|
|
|
|
|
|
by marcosdumay
980 days ago
|
|
|
> The answer here is just to store your session JWTs in HttpOnly secure cookies And set CORS correctly (probably by not having anything in it), and deal with CSRF, and make sure you don't have any XSS issue. It's definitively not insurmountable. But the XSS problem the article focus on still applies. (You shouldn't have any problem with XSS anyway, it's a solved problem that most of the times shouldn't even require thinking about it to keep it solved.) |
|
|