• 9point6@lemmy.world
    link
    fedilink
    arrow-up
    3
    arrow-down
    8
    ·
    11 months ago

    The point of the cookies being HttpOnly is that it makes them completely inaccessible to client side JavaScript, making a whole load of session hijack/XSS attacks impossible.

    The request for a bearer token here circumvents this protection because then there’s a way for a client to avoid cookies all together, making the API vulnerable again.

    • AVincentInSpace@pawb.social
      link
      fedilink
      English
      arrow-up
      12
      ·
      edit-2
      11 months ago

      Under what circumstance would a web client need to send an Authorization header at all? The browser sends the cookie and the server treats that as equivalent.

      Malicious JavaScript in that case could theoretically forge a request using an auth token it acquired some other way by sending it as Authorization: Bearer in addition to the cookie, but 1) this would be extremely easy to defend against (just check for the cookie before you check the Authorization header) and 2) it would still not allow malicious JS code to access the user’s auth token which was still stored in an HTTP only cookie, or really do anything that server side code (read: script kiddie scripts) couldn’t, apart from sending a request from the web client’s IP address.

    • JakenVeina@lemm.ee
      link
      fedilink
      arrow-up
      10
      ·
      11 months ago

      it makes them completely inaccessible to client side JavaScript

      Dude literally said to do this for browser clients, and only support bearer tokens for non browser clients.