Introduction
In this article, We going to talk about cookies in sveltekit and learn how to handle authentication with Cookies after svel...
For further actions, you may consider blocking this person and/or reporting abuse
Never, Never NEVER !!!!!11111one one one
Don't set raw userId as auth data:
cookies.set('session', user.entityId,- It's an easy way to hijack your administrator account.Important data should be signed, eg use
cookie-signatureor put data in JWT / unique UUID for sessionThanks for this important hint.
Can you explain it a little further, or give me a link?
You must remember that any value can be modified in such a way as to harm your application. In this case, after logging in, your id is provided and your permissions are retrieved based on this.
The attacker can craft the message and gain administrator privileges.
Yeah that's true. Have a look at project.
I'm not sure this will help you or not
Github - EtherCare
I'll use token or jwt for this kind of thing. This project is for testing redis as primary db so i did that.
Ok, you won't that, but don't show bad behavior. Some _script-kid _will copy it mindlessly, and then there will be crying and gnashing of teeth ...
Don't worry I'll be pushing my whole project this weekend which might be helpful and i would love if you suggest something after those changes. But json tokens are easy to crack.
Thank you. Couldn't figure out how to use the
Cookies. I was about to lose my mindHappy to help🤩
Ayo uhhhhh definitely don’t do that with your stores. You’re setting a store value to a global variable. If that gets called/ran by the server side you’re toast lol. Extremely dangerous. Everybody now has everyone else’s info.
I know what you saying, for e.g. i'm assigning locals data to users store after data is validated from sever and cleared even if it's server side rendered it won't going to cause problem but there are scenario's where it's way more dangerous.
Do you have a example repo for this tut?
github.com/theetherGit/EtherCare