XSS auth token attack

[Allcharles]

Storing the auth token in local storage is fine for now, however it leaves the site open to an XSS attack. Following something like this https://blog.angular-university.io/angular-jwt-authentication/ using HTTP cookies with XFRS protection may be another simple solution.

[atruskie]

I'm not convinced using cookies for storage is ideal - we expressly moved away from that concept years ago.

Ok I've done some reading:

• http-only cookie + XSRF cookie token is ideal for SPA
  • given our relative lack of 3rd party scripts local storage probably continues to be secure for now
  • with the exception of supply-chain attack - but we can't protect against that with these mechanisms currently
• JWT sent by Authorization header with bearer token ideal for non-spa access
• server should exclusively accept one of the above methods for a single request

The JWKS thing is interesting, we should add support in the server.