- A JSON Web Token (JWT) is used for authenticating and managing users in an application. -
-- Only Decoding JWTs without checking if they have a valid signature or not can lead to security vulnerabilities. -
- -- Don't use methods that only decode JWT, Instead use methods that verify the signature of JWT. -
- -- The following code you can see an Example from a popular Library. -
- -- A JSON Web Token (JWT) is used for authenticating and managing users in an application. -
-- Decoding JWTs with a Constant hardcoded secret key can lead to security vulnerabilities. -
- -- Generate seceret key in application startup with secure randome generators. -
- -- The following code you can see an Example from a popular Library. -
- -Cookies without the Secure flag set may be transmittd using HTTP instead of HTTPS, which leaves it vulnerable to being read by a third party.
Cookies without the HttpOnly flag set are accessible to JavaScript running in the same origin. In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.
Cookies with the SameSite attribute set to 'None' will be sent with cross-origin requests, which can be controlled by third-party JavaScript code and allow for Cross-Site Request Forgery (CSRF) attacks.
Always set secure to True or add "; Secure;" to the cookie's raw value.
Always set httponly to True or add "; HttpOnly;" to the cookie's raw value.
Always set samesite to Lax or Strict, or add "; SameSite=Lax;", or
+"; Samesite=Strict;" to the cookie's raw header value.
In the following examples, the cases marked GOOD show secure cookie attributes being set; whereas in the cases marked BAD they are not set.
+Setting the 'secure' flag on a cookie to False can cause it to be sent in cleartext.
-Setting the 'httponly' flag on a cookie to False may allow attackers access it via JavaScript.
-Setting the 'samesite' flag on a cookie to 'None' will make the cookie to be sent in third-party
-contexts which may be attacker-controlled.
Always set secure to True or add "; Secure;" to the cookie's raw value.
Always set httponly to True or add "; HttpOnly;" to the cookie's raw value.
Always set samesite to Lax or Strict, or add "; SameSite=Lax;", or
-"; Samesite=Strict;" to the cookie's raw header value.
This example shows two ways of adding a cookie to a Flask response. The first way uses set_cookie's
-secure flag and the second adds the secure flag in the cookie's raw value.