Using web standards to harden security
Security is one of the most important aspects when creating a web application. Whole companies have been victims of compromised security, so you can imagine what happens to single projects. To prevent such extreme scenarios, we need to keep a very close eye on potential security issues.
Quite often, security issues arise when the implementation of our solution deviates from the official standards. For instance, if for some reason we want to avoid session cookies as a means of authentication in our application, we could use a JSON Web Token (JWT) instead.
While the security aspects of a JWT deserve their own book, most security problems with this approach will come down to the question “Where should it be stored in the user’s browser?”. With a session cookie, this question would not be asked. The browser takes care of storing and providing it to the appropriate requests. The browser also restricts access to the session...
