Skip to main content
12 votes

Is storing authentication tokens in local storage with a strong CSP safe?

... prohibits all JS except the one I bundle my app, XSS attacks should be essentially impossible This assumes that your (trusted) JS is free from exploitable bugs. ... is there still a security ...
Steffen Ullrich's user avatar
8 votes
Accepted

HTTPonly token without CSRF is safe?

There are several ways, but these ones are especially relevant to your question: XSS (Cross-Site Scripting) for remote control. The HttpOnly flag only prevents script from reading the cookie; it does ...
CBHacking's user avatar
  • 49.1k
6 votes

Is storing authentication tokens in local storage with a strong CSP safe?

I would not place that much trust in CSP to be honest. I'm currently trying to tighten the CSP headers on a reasonably complex project. Some issues I'd worry about: Third party components may require ...
marcelm's user avatar
  • 1,008
4 votes

Where to store JWT refresh tokens

Your question isn't clear whether you mean in the client (the thing that first receives and then uses the refresh token) or the server (where the token is generated and then consumed), nor as to ...
CBHacking's user avatar
  • 49.1k
4 votes

Is storing authentication tokens in local storage with a strong CSP safe?

Assuming that you set a strong Content Security Policy, is there still a security advantage of storing credentials/sessions in cookies over local storage? The advantage isn't that significant to ...
tim's user avatar
  • 29.6k
3 votes

HTTPonly token without CSRF is safe?

CSRF attacks don't require JavaScript access to the session ID. In fact, they are typically performed from other sites (hence the name Cross-Site Request Forgery) which are already blocked from ...
Ja1024's user avatar
  • 9,072
3 votes
Accepted

Why wouldn't a site's cookies be sent in this scenario?

The "Strict" mode for cookies' samesite flag prevents the cookie from being sent on any request that originates outside the current site (including from things like "user clicked a link ...
CBHacking's user avatar
  • 49.1k
2 votes

What are Cookies SQL injection?

I'm fairly sure it is just what the name implies - A cookie is a key/value pair which is sent between the server and client to track state between web pages. SQL injection is tricking the ...
davidgo's user avatar
  • 611
2 votes

Is prohibiting cookies a viable CORS alternative?

I think you have fundamentally misunderstood CORS. The short answer to your question is "NO", because that question doesn't even make sense; there exist alternatives to CORS (see the bottom ...
CBHacking's user avatar
  • 49.1k
2 votes
Accepted

Is using two cookies one Lax and one Strict a way to improve usability without compromising security?

If the redirection from example.com/intermediate/page to example.com/should/be/logged/sensitive happens automatically, the strict cookie is sent (unless it is an HTTP redirect, see here). If example....
Heiko Theißen's user avatar
2 votes

Running blog under /blog, security considerations

From a security perspective, you should definitely run the blog under a subdomain, not a path on the main domain. The same-origin policy isolates the subdomain from the main domain to some degree. ...
Ja1024's user avatar
  • 9,072
1 vote
Accepted

What are the consequences of cookies, including the session cookie, being stolen?

The consequences depend on what exactly the cookies contain and whether there's any abuse protection (like binding the cookie to the IP address or forcing the user to re-authenticate with their ...
Ja1024's user avatar
  • 9,072
1 vote

Is it possible to trick a user into logging in to a site, then stealing a non HttpOnly cookie that will be set after they log in?

My question is whether it's possible to trick the user into logging in One possible way this can be accomplished is with a CSRF attack on the logout functionality. Logout is often not protected from ...
Sjoerd's user avatar
  • 30.9k
1 vote

how to send cookies or token in local storage to a remote server using reflected XSS

Do you understand how / why the approach with the Image is supposed to work? You're effectively creating an HTML <img src=...> tag, where the source is a URL starting with your listener and ...
CBHacking's user avatar
  • 49.1k
1 vote

Does saving the cookie or jwt token in the browser raise a security risk?

Unless you want to want to enter your credentials before every request, some authentication information (token, session ID etc.), must be stored somewhere in the browser. There's no way around that. ...
Ja1024's user avatar
  • 9,072
1 vote

Secure access and refresh token handling in a SPA

Your design is, broadly speaking, good. While you shouldn't count on keeping the access token in a JS closure being sufficient to avoid its exposure through XSS - if nothing else, an attacker with XSS ...
CBHacking's user avatar
  • 49.1k
1 vote
Accepted

Double Submit Cookie Bypass

There seem to be some confusions with regards to the double-submit pattern and cookies in general. First off, when attacker.com triggers a request to victim.com, the browser may very well include ...
Ja1024's user avatar
  • 9,072
1 vote

What are Cookies SQL injection?

The best solutions to SQL Injection (regardless of vector) are generally multi-layered, and involve at a minimum: validate and sanitize ALL input, be it from URL args, Cookie values, user input, etc. ...
Frank Thomas's user avatar
1 vote
Accepted

How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?

Broadly, the approach makes sense. You should delete (set to expire in the past) any "old_cookie" you receive at the same time you set the new one to move users over as quickly as possible ...
CBHacking's user avatar
  • 49.1k
1 vote
Accepted

What sort of cookie is this website giving users

The session cookie is base64-encoded JSON, which is apparent by it beginning with ey.... When decoded, it reveals three parameters: IV, value and mac. IV is a cryptographic term, "initialization ...
Sergej's user avatar
  • 164
1 vote

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

When you talk about JWT, I guess you are talking about the id_token which is the only token which is required to be a JWT by OpenID Connect. You can actually do better than that. Your frontend ...
ysdx's user avatar
  • 1,656
1 vote
Accepted

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

do you see any problem / risk in simply using the session cookies of the web platform as the auth tokens of the mobile app, as soon as authenticated? No. Using cookies for authentication can be ...
Sjoerd's user avatar
  • 30.9k
1 vote

Should I return JWT tokens on a login route even if I am using cookies?

Cookie-based authentication is considered relatively insecure also. While JWT offers protection against CSRF attacks, they do leave you vulnerable to XSS attacks. This is due to the fact that a ...
Eugen Sunic's user avatar
1 vote

AES ECB cookie bypass

You don't need repetitive patterns. Since the encryption doesn't involve any integrity protection, you can inject your own plaintext using the URL parameter svc, obtain the encrypted cookie and then ...
Ja1024's user avatar
  • 9,072

Only top scored, non community-wiki answers of a minimum length are eligible