{"action":"created","issue":{"url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/1933","repository_url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack","labels_url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/1933/labels{/name}","comments_url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/1933/comments","events_url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/1933/events","html_url":"https://github.com/angular-fullstack/generator-angular-fullstack/issues/1933","id":157223471,"number":1933,"title":"Why use cookies?","user":{"login":"ashishbajaj99","id":4930248,"avatar_url":"https://avatars.githubusercontent.com/u/4930248?v=3","gravatar_id":"","url":"https://api.github.com/users/ashishbajaj99","html_url":"https://github.com/ashishbajaj99","followers_url":"https://api.github.com/users/ashishbajaj99/followers","following_url":"https://api.github.com/users/ashishbajaj99/following{/other_user}","gists_url":"https://api.github.com/users/ashishbajaj99/gists{/gist_id}","starred_url":"https://api.github.com/users/ashishbajaj99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashishbajaj99/subscriptions","organizations_url":"https://api.github.com/users/ashishbajaj99/orgs","repos_url":"https://api.github.com/users/ashishbajaj99/repos","events_url":"https://api.github.com/users/ashishbajaj99/events{/privacy}","received_events_url":"https://api.github.com/users/ashishbajaj99/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/labels/enhancement","name":"enhancement","color":"009800"},{"url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/labels/question","name":"question","color":"cc317c"},{"url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-05-27T14:48:59Z","updated_at":"2016-06-27T21:37:00Z","closed_at":"2016-06-23T00:50:02Z","body":" This is a conceptual question on a design choice made with the generator. Based on my reading of the code, I noticed that we are using JWT along with Cookies, its kind of a blend of the new world (JWT) and the traditional world (Cookies).\r\n\r\nWanted to understand what is driving the design choice?\r\nWhat is the downside of simply using JWT without using cookies, i.e. eliminate cookies completely. The upside of doing this ofcourse is CORS and making the API work with multitude of devices like phone apps, other servers, etc.\r\nAlso you can then do away with lusca, cookie-parser, session management including the concept of sticky sessions and simplify the server quite a bit. \r\n\r\nWhat is the opinion on this?"},"comment":{"url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/comments/228883320","html_url":"https://github.com/angular-fullstack/generator-angular-fullstack/issues/1933#issuecomment-228883320","issue_url":"https://api.github.com/repos/angular-fullstack/generator-angular-fullstack/issues/1933","id":228883320,"user":{"login":"mccleanp","id":11406441,"avatar_url":"https://avatars.githubusercontent.com/u/11406441?v=3","gravatar_id":"","url":"https://api.github.com/users/mccleanp","html_url":"https://github.com/mccleanp","followers_url":"https://api.github.com/users/mccleanp/followers","following_url":"https://api.github.com/users/mccleanp/following{/other_user}","gists_url":"https://api.github.com/users/mccleanp/gists{/gist_id}","starred_url":"https://api.github.com/users/mccleanp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mccleanp/subscriptions","organizations_url":"https://api.github.com/users/mccleanp/orgs","repos_url":"https://api.github.com/users/mccleanp/repos","events_url":"https://api.github.com/users/mccleanp/events{/privacy}","received_events_url":"https://api.github.com/users/mccleanp/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T21:37:00Z","updated_at":"2016-06-27T21:37:00Z","body":"The cookie used in the generator does *not* have the HttpOnly flag set, so from what I understand it is open to theft via an XSS attack, in exactly the same manner as the sessionStorage/localStorage.\r\n\r\nThe HttpOnly flag cannot be set in this case otherwise the Angular app could not access the token.\r\n\r\nTraditional session security relies on two cookies: a HttpOnly session id cookie and a XSRF cookie.\r\n\r\nThe JWT token solution is certainly neat, but I am not sure it can be considered 'more secure' than traditional sessions."}}
{"actor":{"display_login":"mccleanp"}}