Timeline for How do you securely delete httpOnly cookies previously used for login?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 11, 2020 at 9:09 | vote | accept | Munchkin | ||
| Mar 5, 2020 at 6:15 | answer | added | Yogi Gachinmath | timeline score: 6 | |
| Dec 17, 2019 at 15:07 | comment | added | Munchkin | @MechMK1 but they have server-side expiration checking (which I implemented) or am I missing something here? | |
| Dec 17, 2019 at 14:13 | comment | added | user163495 | The problem with JWT tokens is that they can't be invalidated easily. Deleting it doesn't invalidate it. | |
| Dec 17, 2019 at 6:35 | review | Close votes | |||
| Jan 10, 2020 at 11:07 | |||||
| Dec 16, 2019 at 14:40 | comment | added | Munchkin | @ConorMancone Is the method to accomplish this secure? Only CSRF is an attack surface? | |
| Dec 16, 2019 at 13:15 | comment | added | Conor Mancone |
I'm not really sure what you are looking for because you have all the details in your question. Http-only cookies can't be deleted client side so you have to send the user to a page (aka /logout) where the back end application will delete the cookie. You've already answered your own question. What else are you looking for?
|
|
| Dec 16, 2019 at 10:04 | history | edited | Munchkin | CC BY-SA 4.0 |
added more info, one more tag
|
| Dec 16, 2019 at 9:55 | review | First posts | |||
| Dec 16, 2019 at 11:55 | |||||
| Dec 16, 2019 at 9:51 | history | asked | Munchkin | CC BY-SA 4.0 |