can any one answer why cookies are getting clear when refresh the page ?
@user-rm5qq1gd4q4 ай бұрын
Hello Coach, Hope this message finds you well. I'm reaching out to you today because I believe your courses have the potential to attract a significant number of students and generate positive reviews. Would you be interested in proceeding further? Here are my marketing plan to promote your Udemy course to attract more students and gain many positive 5 stars reviews: 1. Offering free Coupon: Provide a taste of your course content with a free coupon to enroll 1000 students in 5 days. 2. Utilizing Social Media 3. Email Marketing Campaign 4. And possibly running ads. I'm looking forward to hearing from you soon. Thanks.
@aschelocke52874 ай бұрын
But doesnvt the refresh token have the same problem as the cookie? Can't an attacker just make a request with the refresh token and get the jwt that way?
@henrynwosu62774 ай бұрын
Great Video. Thanks alot. I gave a question. Why not just store the JWT token inside the HTTP only cookie since XSS attacks can't get to it. Instead of the hassle of using a refresh token. Thank you.
@user-uz5iq6my2k5 ай бұрын
I searched a lot about these refresh token and access token, finally, I understood what's going on. Thank you sir
@MikeBrownphx5 ай бұрын
This was/is a phenomenal video. Though not titled microservices, this is the only video that I've found that helped me with the front end side of handling APIs. Thank you for making this.
@syffs-sq6bw8 ай бұрын
the fact that your previous app got hacked through XSS has absolutely nothing to do with the JWT being in localStorage as a sole fact. So it's absolutely deceptive to advertise to "Stop using local storage". So many people get their facts wrong, end up getting to the wrong conclusion, and spread it out anyway... LocalStorage, in memory using closure or session, should all be considered vulnerable to XSS. With that in mind you should: 1. make expiration time small (15-30mins) 2. make sure the jwt is unusable outside of the user's browser by using a fingerprint (in short, random string that you hash, include to the JWT payload, and set the cleartext as an httpOnly, secure, sameSite strict cookie) to verify all requests (if token's fingerprintHash !== hash(cleartextFingerprint), smthg's wrong) 3. sanitize any user inputs (text, images, anythg..), and be obviously very careful when rendering them 4. for UX, using refresh tokens as httpOnly, secure, sameSite strict cookie is acceptable
@EmmanuelOdii80 Жыл бұрын
This is cool bro
@EmmanuelOdii80 Жыл бұрын
Thanks bro :)
@rajatpratapsingh3123 Жыл бұрын
Important thing to highlight that such an approach is great for web browser applications but not a good idea to follow it if we are creating same Auth API for IOS or Android as they don't have the cookies mechanism.
For browser-based applications: When the user logs in or authenticates, your server can generate a JWT token and set it as a cookie in the HTTP response. The cookie should have the HttpOnly flag set to prevent client-side JavaScript access for enhanced security. The browser will automatically include this cookie in subsequent requests to your API. For native mobile applications: In the case of native mobile applications, cookies are typically not managed by the application directly. Instead, you can handle the token management manually by extracting the JWT token from the server's response and storing it securely within the mobile application. You have several options for storing the token securely, such as using the Keychain (iOS) or Keystore (Android) mechanisms mentioned earlier.
@Rubarez Жыл бұрын
Nice but csrf?
@AnuragPradhan101 Жыл бұрын
Problem with this method is, if someone gets the refresh token, they may infinitely keep on getting new tokens. One would say, to tackle this issue, keep the expiry time of small duration. However, it’ll create another issue. Suppose, if I shut down my system and come back the next day, the refresh token would have expired by now. Therefore, I’ll have to log in again. What could be the potential solution to such problems?
@jamessondecastro5785 Жыл бұрын
Did you work in WD before?
@johnn8643 Жыл бұрын
Why does the thumbnail looks like a meme
@REAZNx Жыл бұрын
There’s nothing wrong with storing tokens in local storage. If your site has XSS vulnerabilities, you have much bigger issues.
@omphemetsemafoko830 Жыл бұрын
Thank you
@__8868 Жыл бұрын
Thanks. Concise examples of a modern testing pattern. Much appreciated
@JavidBahramzy Жыл бұрын
Good work. Where are the rest of series? Are you going to work on the next episodes in the series?
@dpkreativ Жыл бұрын
Thanks for this Kati!
@prak-familiarai Жыл бұрын
very well explained
@TheDazedly Жыл бұрын
Haha did he just say "bug free application"? 😂🤣
@IcBlog-jj3bx Жыл бұрын
Great info and thank you for sharing sir, I can see you are setting the new token to the header after the request inorder to persist it. How can you do this with axios, meaning how can you set a header after request with axios or am I missing something.
@hakeemabdulmalik5229 Жыл бұрын
Hey, I went to your site and signed up for the react testing class and the videos were set to private. I think your videos are really good!
@nikolaskadric7093 Жыл бұрын
Which text extension do you use?
@nikolaskadric7093 Жыл бұрын
or theme extension
@EricSalosny Жыл бұрын
Thanks so much!
@prasad_yt Жыл бұрын
Great explanation!
@igordasunddas3377 Жыл бұрын
How would you handle same application in multiple tabs? Or on multiple devices?
@ajk7151 Жыл бұрын
excellent tutorial! explained in a crisp & understandable way. thank you very much. :)
@breezycodes Жыл бұрын
Wow.. I keep learning about new CMS apps each day.. gonna give this a try
@MuhammadShahid-zd9ow Жыл бұрын
he BOUGHT the software hahahahahah
@aydnbilgin1627 Жыл бұрын
Thank u so much, interested in starting so soft during quarintine and just need a place to get started, thx for the support
@aamadeo Жыл бұрын
Great video! have your like good man !
@aydnbilgin1627 Жыл бұрын
Thanks for the kind words, I'm always happy to help! Let know if you'd like any videos on specific topics in the future. I wish you all the
@gurpalsk2 жыл бұрын
I have been struggling with building a database for a SaaS application and your video has helped me solve it. Thanks a million Kati
@Alan.livingston2 жыл бұрын
Nice.
@GermanMantilla2 жыл бұрын
Bravo, great explanation, thanks for sharing
@zehijean88172 жыл бұрын
by storing the refresh token in a httponly cookie, does it prevent an attacker from using it ? my current set up is quite the same ,storing the access token in memory and returning it in a response body from the server and at the same time the server sets up a httponly cookie containing the refresh token...For now i havent found a way to encrypt and sign the token (i am using ktor for the backend) as i use a call.response.cookies.append() method to set my cookie
@RdozeTV2 жыл бұрын
How to pass cookies in testing to getserversideprops? I got error Cannot read property 'cookies' undefined
@clasesutnfrc86992 жыл бұрын
03:44 Backend response 04:06 Not using local storage | Immunity to cross-site scripting attacks
@lotkutv23922 жыл бұрын
tysm almost a week I searching about the refresh token huhu finally you saved me tysm!
@SkyaTura2 жыл бұрын
How could a PWA get the user information using this strategy while offline or on a unstable connection?
@GeordyJames2 жыл бұрын
I know everyone is hyping that don’t store tokens in local or session storage. But the reality is if your application is vulnerable to XSS attacks then an attacker can high jacks your tokens stored even in http only cookie by triggering an fetch request to his malicious domain with credentials set to true. So I personally think that we should give more focus on preventing any sort of XSS vulnerabilities in our site rather than deciding where we store our tokens. Personally I prefer session storage as it expires when user closes browser tab. Also please note that I am not saying that author is completely wrong. This is a good quality video. Just saying that this approach will also fails if we have XSS vulnerability.
@DanielFelipeKlotz11 ай бұрын
If the cookie is set with the sameSite flag, then the attacker will not be able to trigger a fetch request to his malicious domain.
@henrynwosu62774 ай бұрын
You could configure CORS for specific domains of your clients.
@ifeoraokechukwu13462 жыл бұрын
Hello Franz, very nice video!! Great content too! However, you left out something. The cookie holding the refresh token is still susceptible to CSRF attacks. And once that happens, it’s game over. HttpOnly alone won’t save the cookie from CSRF attacks. You need additional settings on the refresh-token cookie 🍪 for GraphQL. Namely: Path: /graphql; Domain: localhost:4500; SameSite: Strict. Now, with these additional settings, the refresh-token cookie is not vulnerable to CSRF via abuse of ambient authority on cross-site, cross-domain scenarios
@abdulhaimohamed Жыл бұрын
Hi Ifeora, i want ask different question , why i need refresh token? i mean if the security comes from the cookie flags((flags: HttpOnly + Secure + SameSite )) , so why i even need to refresh token ? why not to simply store the access token in the secure cookie flags (flags: HttpOnly + Secure + SameSite )
@nuclearcoil2 жыл бұрын
I do not understand why people completely stopped talking about CSRF-attacks. Developers actually stopped using httpOnly cookies and went for localStorage for a reason. Cookies, httpOnly or not, are very much prone to an attack. They are not prone to an XSS-attack but they are prone to a CSRF-attack. localStorage are not prone to CSRF though. And if XSS does happen then even with well protected cookies an attacker has huge power and still is able to make a lot of damage.
@joshua.hintze7 ай бұрын
No expert, but I think the new suggestion is to use sameSite strict or lax.
@rizadwiandhika92532 жыл бұрын
Hi, isn't the refresh token is vulnerable to CSRF attack?
@josephthomasehigie58092 жыл бұрын
This is amazing
@ezekieeeeel2 жыл бұрын
Thanks, man.
@BHFJohnny2 жыл бұрын
Huh, that was very useful. Thank you. You may have just saved my ass :D
@rizadwiandhika92532 жыл бұрын
Damnn!! this is what every JWT newbie needs to know how to understand the refresh token & its usage in the front end 🔥. Thank you Sir!!!
@EnesKab2 жыл бұрын
That looks super promising. After sanity, strapi and all these heavy headless CMSs, Tensei looks refreshing and super comfy. I have checked if I can see any tutorials around but couldn't find any. Is there any resources out there except official docs? Thank you !