Item — HN Reader

> Then, store the token in a secure cookie. It's way more secure than moving a token into the browser, where a dependency vulnerability could get access to it.

Cookies are still in the browser so what difference are you specifically addressing or advocating

1 comments

Secure, encrypted, same site, http only cookies cannot be accessed by JavaScript.

Sign it as well!

For instance: https://github.com/gorilla/securecookie

Unless I'm missing something and the payload is effectively signed. Either way, I still like to have signing generically done at this level of abstraction. Then I can put whatever in there.

Sometimes the encrypted payload is also signed too - maybe with a per-user secret. Now "log out everywhere" is as simple as scrambling the user's secret, thus invalidating their cookies. Simple.