treechicken@lemmy.world to Programmer Humor@lemmy.ml · 1 year agoSPAs were a mistakelemmy.worldimagemessage-square7fedilinkarrow-up15arrow-down10
arrow-up15arrow-down1imageSPAs were a mistakelemmy.worldtreechicken@lemmy.world to Programmer Humor@lemmy.ml · 1 year agomessage-square7fedilink
minus-squareAVincentInSpace@pawb.sociallinkfedilinkEnglisharrow-up1·1 year ago…so allow…either? What’s so hard about checking two headers (Authorization: and Cookie:) for the authtoken?
minus-squareimmortaly007@feddit.nllinkfedilinkarrow-up1·1 year agoIt’s a security thing. The HttpOnly cookie can’t be stolen using XSS or something like that, while a bearer token must be stored somewhere where javascript can see it.
…so allow…either?
What’s so hard about checking two headers (
Authorization:andCookie:) for the authtoken?It’s a security thing. The HttpOnly cookie can’t be stolen using XSS or something like that, while a bearer token must be stored somewhere where javascript can see it.