Make Auth0 cookie more secure - Githubissues

CheriseCodes / ai-flash-cards

Generate Anki flashcards for language learning using OpenAI tools (ChatGPT and DALLE)

1 stars 0 forks source link

Make Auth0 cookie more secure #62

Open CheriseCodes opened 10 months ago

CheriseCodes commented 10 months ago

Option 1: HttpOnly attribute

Requires moving all auth to the backend so HTTP Set-Cookie header can be used
https://owasp.org/www-community/HttpOnly

Option 2: Secure attribue

Requires setting up HTTPS dev environment
https://owasp.org/www-community/controls/SecureCookieAttribute

Option 3: SameSite attribute

Currently set to Lax
Can change to SameSite=None; Secure or SameSite=Strict
https://owasp.org/www-community/SameSite

Can proxy with NGINX: https://www.f5.com/company/blog/nginx/nginx-plus-r23-released?&_ga=2.183812390.1688744185.1719355864-884763757.1719355864#cookie-flags