New answers tagged

0 votes

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

Your description is correct. The use of cookies has the preference here in terms of security. However, the HttpOnly flag is not the only thing that is required for optimal security. Set the SameSite ...
user avatar
  • 337
0 votes

Can a password change via CSRF lead to account takeover?

I also don't know what's the vulnerability and impact, because attackers can't change the other use'sr password without sending a link. And if the attacker sends a link and the user clicks and logs in ...
user avatar

Top 50 recent answers are included