2

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to put the auth token (such as a JWT) in a secure HTTP-only cookie to protect from XSS. This seems to have a couple of consequences:

But what is the real downside to just storing the auth token in browser storage (i.e. session storage)? XSS becomes slightly more convenient for the attacker? Even with an HTTP-only cookie the attacker can still use the auth token by making requests directly from the site, because if there's a XSS vulnerability then they don't need to be able to read the token to use it.

It seems that the popular recommendation just makes things more complicated to protect against CSRF just to make things a little more difficult for the attacker in the case of XSS. Due to the amount of resources making these recommendations I feel like I am missing something and would appreciate any feedback or clarifications!

Here is a couple of sources I've been reading that have been quite adamant against browser storage for auth tokens:

| improve this question | |
  • 2
    Security is always a matter of cost/benefit analysis. If the costs (in increased development/maintenance time) outweigh the benefits (of increased security) for you, then don't do it! To clarify one detail though, it's true that an attacker with an XSS attack can make calls either way, but it takes more effort to set up such an attack, and it is only possible so long as the victim remains on the page with the XSS vulnerability. It is a smaller attack surface. Whether that is worth the extra development cost is your call. – Conor Mancone Dec 6 '19 at 4:20
  • If you want a blanket statement, then the answer is always yes: be secure. If you can take the time to do an in-depth risk assessment (which goes a bit further than the cost/benefit analysis, because it addresses the possibility that things won't just "not work out" but goes to "goes so terribly wrong that ambulance-chasing lawyers will be cackling in glee"), then do so; but the answer will usually be yes, use HTTP-only cookies with TLS 3; don't forget the CSRF, and make damn sure that you're using an approve-list rather than a deny-list for your validation, and never sanitize input. – Ghedipunk Dec 6 '19 at 7:33
  • (That is, the job of sanitizing goes to the functions that generate output, not the ones that process input.) – Ghedipunk Dec 6 '19 at 7:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.