DEV Community

Discussion on: Please Stop Using Local Storage

 
ilusionlinux profile image
Luis Morales • Edited

woow this is one of the best comments in this post.

Thread Thread
 
rugk profile image
rugk

Indeed the original article totally misses the point that local storage is by no means less secure than any other part of your website. If you have an XSS, you are flawed. That's actually the reason why XSS attacks are so serious/bad.

Thread Thread
 
ivankleshnin profile image
Ivan Kleshnin • Edited

If you fetch from the browser, you don't get cookies. You have to add {credentials: "include"}. And that requires a whitelisting on the server. So no, it's no so easy to get httpOnly cookie content in browser as you describe. It requires a TRACE method or other known vulnerability or bug to expose them. Pls. prove me wrong if you think otherwise.

Other than that, I agree with your point. When an app has an XSS injection there are tons of attack vectors a hacker can take. This article is mostly a FUD, unfortunately.

Thread Thread
 
maciek134 profile image
Maciej Sopyło

His point was that you don't need to read the cookie if you can send requests when the user is on the compromised website.