Cookies versus tokens: a paradoxical choice

on YouTube ↗27m

" summary

Compares concrete session patterns (server-state vs client-side JWTs), demonstrates broken code and fixes (shows a decode call that skips JWT signature verification and the correct verify flow), proves how an Angular interceptor token leakage leaks credentials to third parties, and evaluates storage tradeoffs with localStorage vs sessionStorage. Covers CSRF vs CORS/origin checks, cookie flags like SameSite/HttpOnly, session revocation limits, and when simple server sessions beat token-based schemes.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 0:35Session management
3. 1:15Clientside sessions
4. 3:10Session locality
5. 5:40Geotokens
6. 6:50Common mistakes
7. 9:10Cookies
8. 11:40Crosssite request forgery
9. 13:05Crossorigin resource sharing
10. 14:25Preventing crossorigin sharing
11. 15:40Cookies are messy
12. 18:35Summary
13. 22:05Scenarios

" related talks

• 40mTokens Instead of Cookies Thanks to JWTMarkus Schlichting · Voxxed Days Vienna 2016
• 26mThe Science of Authenticating Angular AppsKim Maida · AngularUP 2019
• 15mJWTs And Why They SuckRory M · BSides London 2021
• 24mA Token Walks Into a SPAIgnacio Anaya · VueConf TO 2018
• 26mSecuring Single Page Applications with Token Based AuthenticationStefan Achtsnit · WeAreDevelopers Conference Vienna 2016
• 32mPortable Sessions with JSON Web TokensLance Ivy · RailsConf 2017
• 25mAuthstronomy: The Science of Authenticating Angular AppsKim Maida · ngVikings 2019
• 28mA Token Walks Into a SPA...Ado Kukic · ngVikings 2018