A comprehensive guide to authentication security in modern web applications, covering the progression from localStorage JWT storage (vulnerable to XSS exfiltration) through in-memory tokens, httpOnly cookies with CSRF defenses, server-side sessions vs JWTs, OAuth refresh token rotation, and the Backend for Frontend (BFF) pattern. Key recommendations: store sessions in httpOnly cookies backed by a server-side session store, use CSRF tokens plus SameSite and Origin header checks, and for OAuth flows move all token handling behind a BFF so the browser never holds tokens. Also covers the emerging infostealer/pass-the-cookie threat and Chrome's Device Bound Session Credentials (DBSC) as a hardware-level defense. Includes React-specific code for collapsing concurrent refresh requests into a single in-flight promise.
Table of contents
The version from every tutorial 🔗What XSS does to that token 🔗”If they can run JS, you’re already dead” 🔗Attempt two: hold it in memory 🔗Attempt three: the httpOnly cookie 🔗CSRF 🔗Sessions vs JWTs 🔗Where JWTs work 🔗OAuth 🔗Can we make it more secure? 🔗The NEW threat 🔗Apps overview 🔗References 🔗31.3K Impressions1 Comment