fix

alan2207 · May 3, 2024 · 4f17226 · 4f17226
1 parent 79ff534
commit 4f17226
Show file tree

Hide file tree

Showing 5 changed files with 1,758 additions and 20,283 deletions.
diff --git a/docs/security.md b/docs/security.md
@@ -18,7 +18,7 @@ That is why tokens are stored in a cookie or `localStorage/sessionStorage`..
 
 Storing it in `localStorage` could bring a security issue, if your application is vulnerable to [XSS](https://owasp.org/www-community/attacks/xss/) someone could steal your token.
 
-Storing tokens in a cookie might be safer if the cookie is set to be `HttpOnly` which would mean it wouldn't be accessible from the client side JavaScript.
+Storing tokens in a cookie might be safer if the cookie is set to be `HttpOnly` which would mean it wouldn't be accessible from the client side JavaScript. For simplicity reasons, we are using `js-cookie` to handle cookies in the mocked API, but let's assume that the real API would set the cookie to be `HttpOnly` and we would not have access to it from the client side.
 
 To keep the application safe, instead of focusing only on where to store the token safely, it is recommended to make the entire application as resistant as possible to XSS attacks E.g - every input from the user should be sanitized before it's injected into the DOM.