Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third party javascript from a range of external sources but has a CSP in place, though for a sample of third party domains it has to be liberal.

Theres a requirement to make a Cross Origin request from the browser to an api e.g. mydomain.com -> newdomain.com and we want to share this authentication.

One approach suggested is setting an authorisation header containing the auth token on the clientside request. But for this to be accessible in the client it needs to be stored somewhere in the browser such as the DOM where the JS can retrieve this from.

My concern with this approach is its exposing this credential to third party scripts that could be victim of a bad actor.

Understand cookie based approach also has some cons, e.g. csrf

Are there any best practices in this scenario or recommendations?

  • welcome - please let us know a bit about your environment, constraints, etc. as there are a few options, and various cloud/ infrastructure providers have mechanisms in place to solve this problem
    – brynk
    Jan 7 at 2:11
  • web application is public, initialy server rendered then client spa, hence interaction from browser to api. In the cloud, AWS, api is our own. API utilises AWS api gateway. Always followed not allowing such sensitive data to be accessible by scripts. Although I guess with connect-src directive enabled for some third party domains they could still execute something like: fetch("domain-allowed-in-csp.com", { credentials: "include" })
    – Sam
    Jan 7 at 10:04


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.