Skip to content
loading...

re: Please Stop Using Local Storage VIEW POST

TOP OF THREAD FULL DISCUSSION
re: One problem with the article is that the words 'never' and 'always' are used way too often. Also, the article says that localStorage is insecure q...

woow this is one of the best comments in this post.

Indeed the original article totally misses the point that local storage is by no means less secure than any other part of your website. If you have an XSS, you are flawed. That's actually the reason why XSS attacks are so serious/bad.

If you fetch from the browser, you don't get cookies. You have to add {credentials: "include"}. And that requires a whitelisting on the server. So no, it's no so easy to get httpOnly cookie content in browser as you describe. It requires a TRACE method or other known vulnerability or bug to expose them. Pls. prove me wrong if you think otherwise.

Other than that, I agree with your point. When an app has an XSS injection there are tons of attack vectors a hacker can take. And yes, localStorage is almost the same as cookies security-wise. This article is mostly a FUD, unfortunately.

His point was that you don't need to read the cookie if you can send requests when the user is on the compromised website.

code of conduct - report abuse