On: Cross-Site Request Forgery is dead

[jvehent]

"You may be tempted to use JWT instead of a database of session cookies. Please don't. Here's why: http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.pn... "

source: https://twitter.com/j4cob/status/831286673644216320

[chncdcksn → jvehent]

I may be wrong, but I don't think JavaScripts from a CDN can access the same localStorage as some JavaScript from another origin. (Source: "Cross-origin data storage access" https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...)

[tprynn → chncdcksn]

You are wrong. The 'origin' of a script is the domain which loads it, not the domain where it is hosted. (Those can be the same, though.)

[chncdcksn → tprynn]

TIL. Thanks!