0

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. How backend service can prevent such kind of attacks even if a session cookie become known to a hacker?

2

1 Answer 1

-1

In addition to the cited article, you need to manage the auth token life cycle properly. Decide if you want a cookie, be it jwt or not, to persist beyond one user session. Use expirations. Also, you need to manage authenticated users on the backend in memory or a DB, delete them as cookies expire or users logout. Create a small attack surface.

Not the answer you're looking for? Browse other questions tagged .