rest - JWT stored in cookie - security concerns -

-

i'm building spa app server side rendering, using jwt-based authentication.

current implementation is:

  • jwt token issued , transferred client after successful username , password verification
  • token stored in cookie (not httponly) - purpose of avoid need login again after full refresh or closing page
  • logging out deleted cookie token
  • authorization header attached every api request if token exists
  • full ssl traffic

i can't store token in localstorage because of server side rendering, there no httponly because need access cookie in order construct authorization header.

what possibilities of stealing token in such architecture?

one major risk single cross-site scripting vulnerability in application used steal token cookie, because it's not httponly (while understand why case). xss in javascript-heavy application spa common , hard avoid.

also you're saying token kept in cookie after closing browser, user still logged in. on 1 hand, that's bad practice, user closing browser expects being logged out. on other hand, means cookie persisted disk, easier attacker steal client.

another thing comes mind cross-site request forgery (csrf), if understand correctly, authentication based on authorize header, token copied in each request. if that's case, csrf not issue (but be, if sending token in cookie enough).

so @ least, think should

  • not use persisted cookie token

  • try minimize chance of xss (eg. automatically scanning code, never 100%, choosing secure default technologies)

  • make sure auhentication based on authorize header , not cookie

still because of xss risk, not recommend doing way in security-critical application.


Comments

Post a Comment

Popular posts from this blog

php - How to display all orders for a single product showing the most recent first? Woocommerce -

-
i have password protected page on frontend. on page, want display full list of purchases associated single woocommerce product id. option 1: i've looked through woocommerce docs , , found: wc_cli_order , list_( $args, $assoc_args ) function lists orders. presumably, orders can filtered product id [--=] filter orders based on order property. line item fields (numeric array, started index zero): line_items.0.product_id option 2: i found article , based on customer id. i've modified code based on guesses meta_key , meta_value. $customer_orders = get_posts( array( 'numberposts' => -1, 'meta_key' => '_product', 'meta_value' => get_product_id(), 'post_type' => wc_get_order_types(), 'post_status' => array_keys( wc_get_order_statuses() ), ) ); how display orders single product showing recent order first? here solution put based on these articles: http://www.w...
Read more

asp.net - How to correctly use QUERY_STRING in ISAPI rewrite? -

-
i'm having difficult time , hope guys can help. using helicon isapi rewrite version 3.1.0.104 on our iis server. edit http.conf file , have tried , still fail. this trying do: redirect url: https://www.domain.com/switch-by-version?version=2.8.5.2594 to: https://test.domain.com/load/load.aspx?tver=2.8.5.2594 the version number @ end source url change, , need target url have same version number @ end of url example above shows. i tried following not work: rewritecond %{query_string} ^version=(\d\d?)\.(\d\d?)\.(\d\d?)\.(.*)$ [nc] rewriterule ^/switch-by-version(.*)$ https://test.domain.com/load/load.aspx?tver=%1 [r=307,nc,l] any appreciated! thanks. if it's running in equivalent context of .htaccess , rule shouldn't start / . here's simpler version: rewritecond %{query_string} ^version=(\d+\.\d+\.\d+(?:\..+)?)$ [nc] rewriterule ^switch-by-version/?$ https://test.domain.com/load/load.aspx?tver=%1 [r=307,nc,l]
Read more

angularjs - How restrict admin panel using in backend laravel and admin panel on angular? -

-
https://scotch.io/tutorials/token-based-authentication-for-angularjs-and-laravel-apps following tutorials, try write authentication restrict admin panel, didn't understood how can that. this admin panel, admin panel don't want show , request database unauthenticated users. my laravel-routes route::get('/admin',function(){ return view('index'); }); route::get('/api/v1/employees/{id?}', 'employees@index'); route::get('/api/v1/users/{id?}', 'employees@users'); route::post('/api/v1/employees', 'employees@store'); route::post('/api/v1/employees/{id}', 'employees@update'); route::delete('/api/v1/employees/{id}', 'employees@destroy'); route::group(['prefix' => 'api'], function() { route::resource('authenticate', 'authenticatecontroller', ['only' => ['index']]); route::post('authenticate', 'authentic...
Read more