如果将访问令牌设置为仅HTTP cookie，是否会有任何问题？
这是设置访问令牌的好方法，因为http只有cookie，就像我们对刷新令牌一样？然后，当用户登录时，我们不需要发送访问令牌作为响应。
如果我们喜欢这样，它可以确保访问令牌也将随着每个请求发送。另外，我们不需要为请求设置授权标题（因为访问令牌仅在HTTP中可用，并且将随附所有请求发送）。还可以防止XSS攻击用于访问令牌，因为JS无法仅访问HTTP cookie。有人可以解释一下吗？
如果这样做，我将无法使用客户端应用程序中访问令牌中编码的数据。但是我可以将所需数据作为JSON响应发送并将其存储在本地存储中。我想这比将访问令牌存储在本地存储中是安全的。那是我问题的问题吗？
Isn't it a good way to set access token as http only cookie like we do with refresh token? Then we don't need to send access token as response when user logged in.
If we do like that, it ensure access token will also send with every requests. Also we don't need to set Authorization header for requests(because access token is available in http only cookie and it will send with all the requests). Also it prevents XSS attacks for access token because of JS cannot access http only cookies. Could anyone please explain this?
If I do that, I'll not able to use data encoded in access token in the client side app. But I can send that required data as json response and store them in local storage. I guess it's secure than storing access token in the local storage. Is that the problem of my question?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论