Tag
The article discusses the security implications of storing authentication tokens in localStorage versus cookies, emphasizing the risks of XSS attacks and the benefits of using httpOnly cookies for sensitive apps.
The article argues that injection bugs (XSS and SQL injection) should be prevented structurally through output escaping and avoiding the problem entirely, rather than relying solely on input sanitization.
The article explains how a single XSS vulnerability can defeat the phishing-resistance of passkeys when attestation is set to 'none', allowing attackers to register their own passkeys and achieve persistent account takeover. It calls for attention to this overlooked threat and suggests defenses.