#

csrf

1 post
Showcify Team·Security & Privacy

Moving JWTs out of localStorage: the surprises waiting in ActionController::API

A JS-readable token in localStorage is one XSS away from account takeover. Moving it into an HttpOnly cookie is the well-known fix but ActionController::API has no cookies, no CSRF, and a few other surprises waiting on the first commit.

Jul 30, 202613 min readsecurity
An old key being lifted off a hook on the wall and locked into a wall safe.