3

I have an unpleasant discussion with a colleague who said using session in Java Web Application to validate authenticated users with cookies from Web browser after users logged in is problematic (unsecured mostly and he claimed no one has used this way anymore since 2013).

His idea is to store user's credentials in the Web Browser's local storage instead and any request will need to attach credentials as a basic authentication header.

I don't see any big advantage of his idea and I believe the common way using session and cookie for authentication cannot be dead as he said. He insisted that his way is the best (no session anymore!) and can be used anywhere (well, he is younger than me but more talented anyway).

New contributor
Bằng Rikimaru is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

closed as primarily opinion-based by gnat, Bart van Ingen Schenau, Greg Burghardt, Thomas Owens Sep 10 at 13:59

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Have you asked him to explain why it is insecure? – Philip Kendall Sep 10 at 10:27
  • @PhilipKendall he said I can find the example myself from google. – Bằng Rikimaru Sep 10 at 10:37
  • 1
    He is dead wrong. Recent browsers support HttpOnly cookies and Secure cookies flags to ensure that client side scripts cannot access the cookie and to ensure that the cookies are only sent over HTTPS, that's much more secure than any local storage-based solution. – Lie Ryan Sep 11 at 23:50
  • 1
    In any case, implementing "not-cookie cookie via basic auth" doesn't really benefit the application from security perspective in any way. He might have a point if he suggested using the "not-cookie token" for signing/MAC, but without HTTPS, you cannot exchange signing/MAC key securely anyway, and with HTTPS, signing and MAC is redundant as HTTPS already protects you against anything that message signing/MAC can prevent. – Lie Ryan Sep 11 at 23:56