@ImLunaHey@clxudfast HTTP-only cookie isn’t really secure against XSS.
Sure, the attacker doesn’t get access to your token — but they can still take any actions they want on your account, since all fetches will work authenticated.
@georgedan4th @Aron_Adler @Jonappgar Not just iteratively, but recursively - since deep equality would be needed. So a single a == b could execute thousands of instructions on a huge object
@dillon_mulroy The proposal for this was rejected about a year ago. Unfortunate, but I understand why they decided it wasn't worth it.
TLDR: No existing culture of exception documentation in JS & thus possibly unsound
https://t.co/UE96xxTEKx
@kdy1dev Ooh, that’s tough. Lua seems to be the default choice for stuff like this but it has some language design problems.
Other than Lua, I think JS would be the best choice. Choosing between the two is hard though.
@Swizec Hey - I’ve used this approach in prod and I can say it’s not the way to go.
Turns out that modifying the URL can be _very_ slow on older computers, where it actually freezes the main thread and makes typing annoying/impossible.
I later had to go back and add in denouncing.