Hacker News Reader

Comment by panzi | Hacker News Reader

> - Your Discord session cookies and token could be stolen, leading to a complete account takeover.

Discord uses HttpOnly cookies (except for the cookie consent banner).

tokens are stored in localStorage, which is accessible by JS

Well, it used to be much more accessible before, now you have to do some hack to retrieve it, and by hack, I mean some "window.webpackChunkdiscord_app.push" kinda hack, no longer your usual retrieval. Basically you have to get the token from webpack. The localStorage one does not seem to work anymore. That is what I used, but now it does not work (or rather, not always). The webpack one seems to be reliably good.

So your code goes like:

  // Try localStorage first
  const token = getLocalStorageItem('token')
  if (token) return token

  // Try webpack if localStorage fails
  const webpackToken = await getTokenFromWebpack()
  if (webpackToken) return webpackToken

and localStorage does fail often now. I knew the reason for that (something about them removing it at some point when you load the website?) so you need the webpack way, which is consistently reliable.

I believe if you search for the snippet above, you can find the code for the webpack way.

Discord removes the token from localStorage when the web app is open and it's in app memory, and places it back when you close the tab using the "onbeforeunload" event.

Yeah, that is what I have observed, too.

You can retrieve it the webpack way though.

Reply on news.ycombinator.com