Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Store auth token in a cookie #42

Open
hackerwins opened this issue Aug 12, 2022 · 1 comment
Open

Store auth token in a cookie #42

hackerwins opened this issue Aug 12, 2022 · 1 comment
Labels
cleanup 🧹 Paying off technical debt

Comments

@hackerwins
Copy link
Member

Description:

Store auth token in a cookie.

We implemented the login in #31 but we store the auth token in localStorage.

Since localStorage can be referenced by JavaScript, storing the token in a cookie is recommended.

Let's store the auth token in a cookie.

Why:

  • LocalStorage/SessionStorage is vulnerable to XXS attacks.
@hackerwins hackerwins added good first issue 🐤 Good for newcomers cleanup 🧹 Paying off technical debt labels Aug 12, 2022
@hackerwins hackerwins removed the good first issue 🐤 Good for newcomers label Jan 4, 2023
@chacha912
Copy link
Contributor

chacha912 commented Jan 4, 2023

There are additional considerations in this issue.

The current Dashboard network structure is as follows.
(ref: https://github.com/yorkie-team/dashboard#how-dashboard-works)
image

  • The auth token is transmitted as a cookie from the gRPC server. At this point, set the httpOnly and secure options.
  • The gRPC-web client checks that the cookie is transmitted correctly.
  • After checking that the cookie is set in the browser, Change the login status in the homepage header.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cleanup 🧹 Paying off technical debt
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants