1

In my web application, I have a single API backend and two frontends written as single page applications. To simplify deployment, I'd like to serve the API on /api, the admin dashboard on /admin, and the end user frontend on /user (or something similar), all on the same domain.

I want to use cookies for handling sessions, for both the end-user and admin apps. Is this a good idea? As I understand it, cookie usage is restricted by their domain. Would it make it simpler for an attacker to steal admin-session cookies from someone logged into both frontends? Or, should I use different domains for the admin and user frontends (admin.mydomain.com and user.mydomain.com)?

Improve this question
0

1 Answer 1

Reset to default
3

Cookies can be also restricted by the URL path. In this case you can use the Path attribute in the session cookie:

Path attribute

The Path attribute indicates a URL path that must exist in the requested URL in order to send the Cookie header. The %x2F ("/") character is considered a directory separator, and subdirectories match as well. For example, if Path=/docs is set, these paths match:

/docs

/docs/Web/

/docs/Web/HTTP

For the sessions, it's better to have two different ones:

  • one for the admin endpoint (Path = /admin)
  • one for the user endpoint (Path = /user)

This will prevent privileges escalation (vertical).

To prevent stealing the cookie, you can add the attributes:

  • HttpOnly: prevent access to cookie values via javascript
  • Secure: ensure that cookies are sent securely and are not accessed by unintended parties
  • SameSite: Protect against CSRF

Finally, make sure that your application does not have any XSS vulnerability. You can find more details about how to prevent of it on:

Hope it answer your question.

source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .