this post was submitted on 12 Dec 2023
247 points (95.9% liked)
Programmer Humor
32443 readers
1757 users here now
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's a security thing. The HttpOnly cookie can't be stolen using XSS or something like that, while a bearer token must be stored somewhere where javascript can see it.
Okay.
So make your webpage send the authtoken in a cookie and leave off the
Authorizationheader, and have your third party (presumably native) clients send anAuthorizationheader but not any cookies, and write your server software to check for both.This seems trivial. What am I missing?
The point of the cookies being HttpOnly is that it makes them completely inaccessible to client side JavaScript, making a whole load of session hijack/XSS attacks impossible.
The request for a bearer token here circumvents this protection because then there's a way for a client to avoid cookies all together, making the API vulnerable again.
Dude literally said to do this for browser clients, and only support bearer tokens for non browser clients.