Hacker News Reader

Comment by vindex10 | Hacker News Reader

I would add:

* on the client side, store the token as a secure https only cookie, as local storage is accessible by any module of your app, see supply-chain attacks.

* be extra careful with oAuth [1]

* for APIs, be strict with CORS [2]

[1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove...

[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

View on HN

I'm having to deal with this stuff right now. Firebase stores their refresh token in local storage and that allows minting new session tokens once they expire, are they wrong? Is there any other way to remain signed in "forever"? (until logout or until token is revoked)

I didn't work with Firebase myself, isn't this something relevant?

https://firebase.google.com/docs/auth/admin/manage-cookies

That is what I'm using but I have to authenticate again every few days. If I used the client library it would autorefresh the token periodically, but that stores the refresh token in local storage. Since that is something you recommend against, I was wondering why.

Just to be clear, I'm not a security expert in any way, just learned myself while building things.

So here is what I'd refer to:

https://stackoverflow.com/questions/44133536/is-it-safe-to-s...

Regarding the Firebase, I see an open issue on this, so I guess we are not the only ones wondering :)

https://github.com/firebase/quickstart-nodejs/issues/194

Reply on news.ycombinator.com