Web Security & OWASP (50 Qs)•Part 1: Candid Security Experience, Threat Modeling & Fundamentals (1 - 10)
Session Management & Token Storage: Why localStorage is vulnerable to XSS and how to configure secure cookies.
The Storage Security Dilemma
Single Page Applications (React, Angular, Vue) need to persist user sessions. Storing JWTs or session identifiers in the wrong browser storage medium exposes users to complete account takeover.
sql
+-----------------------+-------------------------------------------------------+
| Storage Location | Vulnerability Profile |
+-----------------------+-------------------------------------------------------+
| localStorage | Accessible via JavaScript (window.localStorage). |
| | ANY Cross-Site Scripting (XSS) flaw exfiltrates token!|
+-----------------------+-------------------------------------------------------+
| sessionStorage | Accessible via JavaScript. Exfiltrated by XSS. |
+-----------------------+-------------------------------------------------------+
| httpOnly, Secure, | INACCESSIBLE to JavaScript. |
| SameSite=Strict Cookie| Completely immune to XSS token theft! |
+-----------------------+-------------------------------------------------------+
Production Hardened Cookie Blueprint
http
Set-Cookie: __Host-session_id=s%3A9f8e7d6c5b4a.xYz123;
Path=/;
Secure;
HttpOnly;
SameSite=Strict;
Max-Age=3600;
Partitioned;
Flag Breakdown
HttpOnly: Prohibits JavaScript (document.cookie) from reading the cookie, neutralizing token theft via XSS.Secure: Browser transmits cookie exclusively over encrypted HTTPS connections (blocks SSL stripping).SameSite=Strict: Cookie is never sent on cross-site requests (e.g. following external links), mitigating CSRF.__Host-Prefix: Browser security policy enforcing that the cookie must havePath=/, must beSecure, and cannot be set or overridden by parent domains or insecure subdomains.