{"action":"created","issue":{"url":"https://api.github.com/repos/hhroc/yellr-server/issues/29","labels_url":"https://api.github.com/repos/hhroc/yellr-server/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/hhroc/yellr-server/issues/29/comments","events_url":"https://api.github.com/repos/hhroc/yellr-server/issues/29/events","html_url":"https://github.com/hhroc/yellr-server/issues/29","id":54105993,"number":29,"title":"(Security) Keep token in session rather than localStorage","user":{"login":"Nolski","id":2600677,"avatar_url":"https://avatars.githubusercontent.com/u/2600677?v=3","gravatar_id":"","url":"https://api.github.com/users/Nolski","html_url":"https://github.com/Nolski","followers_url":"https://api.github.com/users/Nolski/followers","following_url":"https://api.github.com/users/Nolski/following{/other_user}","gists_url":"https://api.github.com/users/Nolski/gists{/gist_id}","starred_url":"https://api.github.com/users/Nolski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nolski/subscriptions","organizations_url":"https://api.github.com/users/Nolski/orgs","repos_url":"https://api.github.com/users/Nolski/repos","events_url":"https://api.github.com/users/Nolski/events{/privacy}","received_events_url":"https://api.github.com/users/Nolski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-12T21:00:22Z","updated_at":"2015-01-12T21:06:02Z","closed_at":null,"body":"Currently we are keeping our authentication token as a variable and storing it in local storage. The issue here is that localStorage is a global object that all websites have access to, so any website that wants can have access to the token that the user uses to log into the admin console.\r\n\r\nInstead I think it would be a better idea to use session variables on the server to authenticate a user.\r\n\r\n@thequbit what do you think?"},"comment":{"url":"https://api.github.com/repos/hhroc/yellr-server/issues/comments/69645804","html_url":"https://github.com/hhroc/yellr-server/issues/29#issuecomment-69645804","issue_url":"https://api.github.com/repos/hhroc/yellr-server/issues/29","id":69645804,"user":{"login":"thequbit","id":772612,"avatar_url":"https://avatars.githubusercontent.com/u/772612?v=3","gravatar_id":"","url":"https://api.github.com/users/thequbit","html_url":"https://github.com/thequbit","followers_url":"https://api.github.com/users/thequbit/followers","following_url":"https://api.github.com/users/thequbit/following{/other_user}","gists_url":"https://api.github.com/users/thequbit/gists{/gist_id}","starred_url":"https://api.github.com/users/thequbit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thequbit/subscriptions","organizations_url":"https://api.github.com/users/thequbit/orgs","repos_url":"https://api.github.com/users/thequbit/repos","events_url":"https://api.github.com/users/thequbit/events{/privacy}","received_events_url":"https://api.github.com/users/thequbit/received_events","type":"User","site_admin":false},"created_at":"2015-01-12T21:06:02Z","updated_at":"2015-01-12T21:06:02Z","body":"Do you have a reference to the statement about localstorage being seen by all websites?  I was under the impression that it is site specific ...\r\n\r\nI can implement the session variable, however the nice part about keeping it as a cookie or localstorage is that you don't have to log back in after a time-out, and it allows for much easier scalability.  If we're load balancing then we need to somehow replicate sessions across all pyramid instances ... that's a bit outside of my wheelhouse.  By keeping it on the client, and sending it as a GET parameter, we get around the scaling issue nice and simply.\r\n\r\nThe token is large enough, and unique enough that it's unlikely to be guessed, and everything will be sitting on https.  I don't see an issue keeping things they way they are ... that is assuming that I am correct that localstorage is sight-specific, and not as you are stating.\r\n"}}