Hacker News Reader

Comment by StrauXX | Hacker News Reader

localStorage is very much fine and arguably superior to cookies for authentication tokens. First of all, once you have achieved JS execution on a target origin, you can send requests, open up malicious "login" prompts and generally control everything the user sees and does. The article mentions this, but plays it down with no good arguments.

Much more importantly however, is that the cookie standards are a mess! The complexity of cookie default behaviour, their flags, scopes, differences in their SOP (cookies ignore ports for example, so https://example.com:443 and https://example.com:8443 share their cookies) are huge. Research papers have been written in this. And don't even get started on differentials between browsing engines.

This huge complexity of cookies opens up a whole class of authentication attacks where bad (or just weirdly) configured cookies can be stolen cross origin.

localStorage on the other hand is practically impossible to get wrong.

View on HN

Cookies also don't work on mobile, so you inevitably have to maintain 2 different login flows.

But they're still the superior choice for authN on the web, because if you want to, you CAN configure cookies to be secure. Yes, attackers can ride the session, but it's dependent on the user being on the tab and you being able to consistently execute JS. Client-side compromise (ie attacker controls the entire browser) is not feasible to defend against anyway.

The main issue with JWT+localStorage is you can actually execute one-off JS, exfiltrate the token and come back later. I've _never_ seen a well-executed JWT+localStorage implementation in 10 or so years, because teams inevitably realise they can't reliably revoke sessions (another advantage of cookies) and then start giving out long-lived access tokens but adding them to the database. Or some variation of that.

> Cookies also don't work on mobile

Instead of speculating, I'll ask: what does this mean?

Not a mobile dev so I'm leaning quite heavily on other people's experiences here.

It's my understnading that setting up cookies to work on mobile is quite painful, though it depends on the platform. IIRC iOS has gotten better at it with a shared cookie storage, but Android requests are still stateless by default, so you basically have to manually wire up a cookie jar and carry it around everywhere you go, so to speak.

Attributes like SameSite also behave differently, and WebViews don't share the same cookie jar as native requests as far as I understand.

Bottom line is that maybe "Cookies also don't work on mobile" is a bit of a wrong statement, but it's certainly more of a hassle and a path lined with more footguns than just wiring up an OAuth provider and sending access and refresh tokens back and forth using Authorization headers. The great thing with Session cookies on desktop is simplicity, which you sort of lack on mobile.

localStorage is not sent to the server when you request a document. So now you threw out the ability to do server-side rendering. This is only fine if you've got a application that always requires authentication, otherwise you risk server vs client mismatch, needless roundtrips, and DOM rewrites.

Of course it isn't. localStorage is used for SPAs.

Reply on news.ycombinator.com