PR to move auth details from local storage to cookies

[obafemitayor]

Related Issue

• Issue-921

What Changed

• Refactored the authentication logic here to store the auth details in the cookies instead of local storage

Testing Strategy

https://www.loom.com/share/f2d07c6c31b94c978900cb01ad8b1fdc

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
find-a-mentor	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 15, 2024 2:57pm
find-a-mentor-jfb1	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Dec 15, 2024 2:57pm

[togakangaroo]

I haven't been involved in the development (just saw a comment asking for a review on the Slack) but isn't the point of moving auth from localStorage to cookies that you want to move to http-only cookies? Otherwise it seems like just a bunch of overhead and no improvement to security?

Typically for a cookie you are going to be dealing with it only on the server since that's where you would set and read it.

[obafemitayor]

I haven't been involved in the development (just saw a comment asking for a review on the Slack) but isn't the point of moving auth from localStorage to cookies that you want to move to http-only cookies? Otherwise it seems like just a bunch of overhead and no improvement to security?

Typically for a cookie you are going to be dealing with it only on the server since that's where you would set and read it.

@togakangaroo I just tried to follow the request of the issue while working on the PR. So if I understand you correctly, you mean the task is actually not to move to a normal cookie but an HTTP cookie?

[togakangaroo]

I haven't been involved in the development (just saw a comment asking for a review on the Slack) but isn't the point of moving auth from localStorage to cookies that you want to move to http-only cookies? Otherwise it seems like just a bunch of overhead and no improvement to security?
Typically for a cookie you are going to be dealing with it only on the server since that's where you would set and read it.

@togakangaroo I just tried to follow the request of the issue while working on the PR. So if I understand you correctly, you mean the task is actually not to move to a normal cookie but an HTTP cookie?

Yeah, I'm guessing that it's not just "put the token in a cookie instead of localStorage" because why would that be useful? The idea would be to actually use it as a cookie. That means it is both set and read only on the server, the client doesn't have to do anything special at all (except do fetch withCredentials).

The benefit to doing that is that when you set the cookie you can put the http-only attribute on it which makes it so that something like a cross-site-scripting attack cannot steal your credentials