Web Storage: the lesser evil for session tokens
Summary: PortSwigger research director James Kettle argues that Web Storage is a viable and often more secure alternative to cookies for session tokens, because Web Storage adheres to the Same Origin Policy while cookies do not. He contends the Secure, path, and HttpOnly cookie attributes are patches that only bring cookies up to Web Storage's default security, and that Web Storage's need for JavaScript to attach tokens removes the ambient authority that enables CSRF and cross-origin timing attacks.
What you should know: The same automatic cookie attachment that makes sessions convenient is what enables CSRF and cross-origin timing attacks, and the Origin attribute proposed to fix it is still in development. Kettle also notes Web Storage is insecure in Internet Explorer 8 and disabled in Safari private browsing, so the choice carries real compatibility costs.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026