Please enable JavaScript.
Coggle requires JavaScript to display documents.
Securing Web App - Coggle Diagram
Securing Web App
CP_Server
Time Expire to the AccessToken :check:
Adding the Content Security Policy :red_cross:
Anti-Forgery Token Mechanisam :red_cross:
WE Are using Passport-Jwt
Option of going with Simple Jwt
CSURF
Helmet
Authorization header to XSRF-TOKEN:
extra middleware along with existing middleware
Refresh Token Mechanisam :red_cross:
Storing Token
Storing Access token in Local storage
it wont allow CSRF Attacks :check:
IN Cookies
storing Token in Cookie is Vulnerable for CSRF Attacks
Better Implementation
Storing Access Token in constant
Storing the Refresh Token in Http only cookie and same site=strict instaed of lax
Setting up cokkies and setting up i authorisation header to xsrf-token