New answers tagged csrf
0
votes
Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?
Your description is correct. The use of cookies has the preference here in terms of security.
However, the HttpOnly flag is not the only thing that is required for optimal security. Set the SameSite ...
- 337
0
votes
Can a password change via CSRF lead to account takeover?
I also don't know what's the vulnerability and impact, because attackers can't change the other use'sr password without sending a link.
And if the attacker sends a link and the user clicks and logs in ...
Top 50 recent answers are included