Hacker Times
new
|
past
|
comments
|
ask
|
show
|
jobs
|
submit
login
Sohcahtoa82
41 days ago
|
parent
|
context
|
favorite
| on:
Stop Using JWTs
HttpOnly makes it so XSS can't
steal
your token, but that won't stop XSS from
using
your token.
unscaled
40 days ago
[–]
True. But XSS stealing your token (which is always possible with localStorage) is still worse than XSS using your token. It's the principle of least privilege all over again.
Consider applying for YC's Fall 2026 batch!
Applications
are open till July 27.
Guidelines
|
FAQ
|
Lists
|
API
|
Security
|
Legal
|
Apply to YC
|
Contact
Search:
