javascript - 使用 ReactJS 将 JWT 存储在 localStorage 中安全吗？

Question

我目前正在使用 ReactJS 构建一个单页面应用程序。

我了解到不使用 localStorage 的原因之一是 XSS 漏洞。

由于 React 转义了所有用户输入，现在使用 localStorage 是否安全？

Answer 1

在大多数现代单页应用程序中，我们确实必须将 token 存储在客户端的某个位置(最常见的用例 - 在页面刷新后保持用户登录状态)。

共有 2 个可用选项:Web 存储( session 存储、本地存储)和客户端 cookie。 这两个选项都被广泛使用，但这并不意味着它们非常安全。

Tom Abbott 很好地总结了 JWT sessionStorage and localStorage security :

Web Storage (localStorage/sessionStorage) is accessible through JavaScript on the same domain. This means that any JavaScript running on your site will have access to web storage, and because of this can be vulnerable to cross-site scripting (XSS) attacks. XSS, in a nutshell, is a type of vulnerability where an attacker can inject JavaScript that will run on your page. Basic XSS attacks attempt to inject JavaScript through form inputs, where the attacker puts <script>alert('You are Hacked');</script> into a form to see if it is run by the browser and can be viewed by other users.

为了防止 XSS，常见的响应是对所有不受信任的数据进行转义和编码。 React(大部分)会为你做到这一点!这是一个很棒的discussion about how much XSS vulnerability protection is React responsible for .

但这并不能涵盖所有可能的漏洞!另一个潜在威胁是使用 CDN 或外部基础设施上托管的 JavaScript。

汤姆又来了:

Modern web apps include 3rd party JavaScript libraries for A/B testing, funnel/market analysis, and ads. We use package managers like Bower to import other peoples’ code into our apps.

What if only one of the scripts you use is compromised? Malicious JavaScript can be embedded on the page, and Web Storage is compromised. These types of XSS attacks can get everyone’s Web Storage that visits your site, without their knowledge. This is probably why a bunch of organizations advise not to store anything of value or trust any information in web storage. This includes session identifiers and tokens.

因此，我的结论是，作为一种存储机制，Web Storage 在传输过程中不强制执行任何安全标准。任何阅读并使用 Web Storage 的人都必须尽职尽责，以确保他们始终通过 HTTPS 而不是 HTTP 发送 JWT。