I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much bigger problems to worry about, and nothing you reinforce your fridge with will be effective anyway".

Is this accurate?

  • Where was this quote from? Context can be important
    – schroeder
    Commented Oct 8, 2020 at 16:36
  • I think it was a dude asking whether cookies were more secure than localstorage. Some folks said cookies were safer, some said that neither were safe against a smart hacker once a XSS attack had begun.
    – Roy He
    Commented Oct 8, 2020 at 16:40
  • I mean: what is the link to this comment?
    – schroeder
    Commented Oct 8, 2020 at 17:03
  • I would think from the perspective of defense-in-depth it would be worthwhile if the resource cost (complexity, development effort, testing, performance, size) isn't overwhelming. But the effort may be better spent elsewhere such as mitigating XSS in the first place. Commented Oct 8, 2020 at 20:15
  • See also Does setting httponly prevent stealing a session using XSS?
    – Sjoerd
    Commented Oct 9, 2020 at 13:25


You must log in to answer this question.

Browse other questions tagged .