undefined | Better HN

0 pointskenniskrag5y ago0 comments

Already exists. Custom HTTP Header with a JWT token for example. Also in the body of a post request can be the auth data. In the URL would also be possible but is a security risk due to e.g. browser history.

0 comments

3 comments · 2 top-level

tester345y ago· 1 in thread

You have to attach that "JWT token" (heh) with e.g JS which makes it vulnerable to XSS, doesn't it?

kenniskragOP5y ago

With xss you can also inject the code. So no cookie extraction needed imho.

kenniskragOP5y ago

advertisment still works, because the site can just execute a js and make a post request to the advertisment company.

1 more reply

j / k navigate · click thread line to collapse