Hacker News Reader

It's a shame because local storage and friends aren't quite as secure (no way to block all JS from accessing it like you can with cookies).

View on HN

What would be the point of localstorage if JS couldn't access it? Cookies can be set and get via http headers, but is localstorage available by other means than JS?

No, it is only accessible from JS. Parent comment does not make sense.

By that logic, we should turn off our computers to improve security.

Is this really an issue? If the attacker has XSS on your site you're already screwed because they can manipulate the DOM to simulate user actions.

It means they can't exfiltrate the cookie, which I think is a pretty nice win, even if they can still perform requests to the domain with that cookie.

For one thing it means they're locked to my session.

How would they steal HTTP-only cookies this way?

They wouldn’t steal the cookie, they’d just have the script send the requests as the user directly.

Reply on news.ycombinator.com