0

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now we have localStorage/sessionStorage, Single-Page Applications, completely stateless APIs with JSON Web Tokens inside Authorization: Bearer headers, __Host- ; HttpOnly; SameSite=Strict; Secure cookies, X-Frame-Options: DENY headers and so on.

However, despite all these improvements, a JWT stored in sessionStorage is still vulnerable to XSS whereas storing it in a cookie would still make it vulnerable to CSRF on old browsers and Cross-Origin API calls.

Would it make sense to split the JWT on the server side, have the signature sent as a cookie while the rest is held in sessionStorage, and later reassemble them on the server side for verification? Would there be any downsides or security issues about it? Would it be overkill?

Improve this question

1 Answer 1

Reset to default
1

NO, JSON Web Token splitting would not make sense

According to this Reddit discussion setting the signature to an HttpOnly cookie would prevent it from being read by an injected script but the attacker would still be capable of sending requests on behalf of the user with the cookie attached to them.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .