7 ms·

Both cookies and localStorage are usually stored in an SQLite db… localStorage is totally accessible to any JavaScript running on the page, so your session can

Both cookies and localStorage are usually stored in an SQLite db… localStorage is totally accessible to any JavaScript running on the page, so your session can be completely hijacked and used later.

madisp 3y ago
> HTTPOnly cookies are safe from XSS attacks. Not completely true - the attacker can not exfiltrate the token but they can still make malicious requests right there in the victim's browser via XSS.
muldvarp 3y ago
> so all it takes is a little injected script If you can inject javascript, it's game over anyway. > HTTPOnly cookies are safe from XSS attacks. No, you can still do pretty much anything that cookie enables you to do. You just can't get the actual cookie string.
- 7sidedmarble 3y ago
  > If you can inject javascript, it's game over anyway. Yeah, but as you pointed out the one thing you can't do is get the cookie. Having the auth token yourself as the attacker is a way different story then just having XSS vulnerabilities. You can still "do" a lot, but you still have to get another user with the token you want to interact with the page with your XSS to "do" what you want.
  - inbx0 3y ago
    Then again, why bother with the tokens if you have XSS access as an attacker? I'd simply show the user a login prompt and take their password when they type it in.
  - muldvarp 3y ago
    > You can still "do" a lot, but you still have to get another user with the token you want to interact with the page with your XSS to "do" what you want. You need to do this in both cases.