Storing tokens in local storage creates security vulnerability and allow attacker to stole token via:
— XSS attack
— NPM supply chain attack (e.g. by injecting malicious code in NPM dependency and it may not even be your direct dependency like [your app] -> [direct dependecy] ->… -> [malicios module])
— Browser extension supply chain attack or phishing attack (e.g. by injecting malicious code in existing extension or tricking user to install doubtful extension)
I highly recomend to store tokens in cookies with HttpOnly flag, that will prevent all listed types of attacks
да
@vovsне подскажете где взять оригинал оригинал картинки организационной диаграммы?
— XSS attack
— NPM supply chain attack (e.g. by injecting malicious code in NPM dependency and it may not even be your direct dependency like [your app] -> [direct dependecy] ->… -> [malicios module])
— Browser extension supply chain attack or phishing attack (e.g. by injecting malicious code in existing extension or tricking user to install doubtful extension)
I highly recomend to store tokens in cookies with HttpOnly flag, that will prevent all listed types of attacks
у меня проблема возникла гораздо раньше, еще в начале 2015-го
тогда этого не было
В NW.js их нет, мейнтейнеры говорят — сами вытаскиваейте билд кодека из Chrome
Для меня это был огромный перевес в сторону Electron'a