As one commenter noted, employing XSS to steal the token out of localStorage is ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		eloisius on May 28, 2015 \| parent \| context \| favorite \| on: Using JSON Web Tokens to Authenticate JavaScript F... As one commenter noted, employing XSS to steal the token out of localStorage is a risk.

nemothekid on May 29, 2015 [–]

Thats a risk against using any session based authentication token, right?

Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact