As an old guy reading this I had a lot of wtf moments during the setup. Then I laughed pretty hard when we eventually got to this line. Like there's a reason we invented cookies and all mature web frameworks use them for auth.
mschuster91 46 minutes ago [-]
> Like there's a reason we invented cookies and all mature web frameworks use them for auth.
Cookie stealers, issues with third-party cookies and tracking... it's not like the past was a paradise, in fact, quite the opposite. Hell I 'member times when we had to append ?PHPSESSID=... to URLs. Cookies were a stopgap...
StrauXX 36 minutes ago [-]
localStorage is very much fine and arguably superior to cookies for authentication tokens. First of all, once you have achieved JS execution on a target origin, you can send requests, open up malicious "login" prompts and generally control everything the user sees and does. The article mentions this, but plays it down with no good arguments.
Much more importantly however, is that the cookie standards are a mess! The complexity of cookie default behaviour, their flags, scopes, differences in their SOP (cookies ignore ports for example, so https://example.com:443 and https://example.com:8443 share their cookies) are huge. Research papers have been written in this. And don't even get started on differentials between browsing engines.
This huge complexity of cookies opens up a whole class of authentication attacks where bad (or just weirdly) configured cookies can be stolen cross origin.
localStorage on the other hand is practically impossible to get wrong.
Lucasoato 10 minutes ago [-]
If I use short-lived JWTs and localstorage, am I such a bad person? Are you truly increasing the blast radius?
Is there someone in another part of the world that would like hacking you only if you’re not using httpOnly cookies, happy to know that you used localstorage?
homebrewer 46 minutes ago [-]
Cookies can be encrypted and signed and contain whatever information you want, not just some random token that has to be looked up in the database to be actually useful.
This is what aspnet core does by default if you enable cookie-based authentication. Gives you the best of both worlds.
stavros 51 minutes ago [-]
Don't use JWTs for session auth, and don't outsource your articles to Claude.
haburka 52 minutes ago [-]
I struggle to underdress why this slop content gets to the front page. It’s likely close to 100% ai made.
I really want this era of AI generated writing that reads so poorly to end. Or at least society should be ashamed of publishing this content.
dprkh 9 minutes ago [-]
They use bots to promote their content to the front page and downvote any comments criticizing them. I observe this pattern consistently on this website.
alt227 15 minutes ago [-]
[dead]
1 hours ago [-]
guessmyname 56 minutes ago [-]
[dead]
Rendered at 08:06:31 GMT+0000 (Coordinated Universal Time) with Vercel.
As an old guy reading this I had a lot of wtf moments during the setup. Then I laughed pretty hard when we eventually got to this line. Like there's a reason we invented cookies and all mature web frameworks use them for auth.
Cookie stealers, issues with third-party cookies and tracking... it's not like the past was a paradise, in fact, quite the opposite. Hell I 'member times when we had to append ?PHPSESSID=... to URLs. Cookies were a stopgap...
Much more importantly however, is that the cookie standards are a mess! The complexity of cookie default behaviour, their flags, scopes, differences in their SOP (cookies ignore ports for example, so https://example.com:443 and https://example.com:8443 share their cookies) are huge. Research papers have been written in this. And don't even get started on differentials between browsing engines.
This huge complexity of cookies opens up a whole class of authentication attacks where bad (or just weirdly) configured cookies can be stolen cross origin.
localStorage on the other hand is practically impossible to get wrong.
Is there someone in another part of the world that would like hacking you only if you’re not using httpOnly cookies, happy to know that you used localstorage?
This is what aspnet core does by default if you enable cookie-based authentication. Gives you the best of both worlds.
I really want this era of AI generated writing that reads so poorly to end. Or at least society should be ashamed of publishing this content.