Authentication in Single Page Applications
summary
Using an Authorization header makes requests “non‑simple” so CORS prevents CSRF, but storing access tokens in JavaScript‑accessible storage lets XSS steal them; using HTTP‑only cookies prevents JS theft but reintroduces CSRF unless mitigated. Recommended patterns include short‑lived access tokens with a refresh token in an HTTP‑only cookie, token rotation plus CORS and synchronizer/encrypted CSRF tokens (Rails uses this), CSP and a separate login subdomain to isolate credentials and reduce real‑world exploitability.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:51User Agent (aka Browser)
- 4:58CSRF vs CORS
- 6:39More passive Anti-CSRF
- 8:02XSS: Targets and Implementations
- 20:38Content Security Policy Level 1
- 21:04CSP + Authorization Header
- 22:21Separate login page
- 24:04Separate login/accounts domain
related talks
30mSingle Page Applications: Is your design secure?
26mSecuring Single Page Applications with Token Based Authentication
59mSecuring Web APIs from JavaScript/SPA Applications
29mToken Security in Single Page Applications
27mMastering Secure Single Page Apps & APIs
52mThe Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery
32mSecurity-First Web Apps
26mThe Science of Authenticating Angular Apps