'What's stopping someone from force logging into cookie authentication with 'document.cookie='?
Let's say you're using express sessions to provide a session cookie & storage. How would you authenticate that a user is actually that user? Can any random person get an "authenticated" cookie and import it into their browser via the developer console document.cookie='cookie=IAMACOOKIE'? At this point they have all access to the account(unless session has expired).
Sorry if this is a dumb question! I'm only recently starting to get into web stuf.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|