I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different).

In order to login (to post comments) the workflow is like this :

  • User clicks on log-in on the wordpress blog
  • A popup opens with the login form on the backend api for my plugin (another site)
  • The user logs in and using PostMessage I send back an access token.

Now with that access token when he does action like upvoting or posting a comment I'll send a post request to my backend api along with the token and if the token is valid I add the comment/upvote to the database.

But I am not sure how to securely handle the user token : My first thought was to put it in a cookie but then any malicious wordpress blog can run some js to automatically steal all the tokens from users who log onto their websites.

And since all of the logging is happening on the front end of the wordpress blog I don't see how I can store data in a way that the backend api can access it when the user does an action but not a malicious blog.

How can I securely store that token ? I thought about embedding the website in an iframe in order to rely on session variables but I am not sure on how secure that is.


That token should be set by your back end server, not the wordpress site that is using your plugin.

If your server then sets httpOnly when issuing the cookie, requests (for example via JavaScript from the wordpress site that uses the plugin) to your backend would have that cookie included in the request by the browser while the javascript itself (from the wordpress page) will not have access to it.

From the OWASP:

If the HttpOnly flag (optional) is included in the HTTP response header, the cookie cannot be accessed through client side script (again if the browser supports this flag). As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.

After all, your question implies that you didn't think your communication model through all the way; this information does never need to be accessible from the scope of the wordpress blog.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.