Using cookies to store sessions in Supabase securely?
Unanswered
New Guinea Singing Dog posted this in #help-forum
New Guinea Singing DogOP
I was thinking about how secure it is to use cookies (so I can auth it through middleware and all around my application) because of non-http cookies and client side JS being able to access it. However, the suapbase docs directly call this out, I was just wondering if someone could explain this more?
4 Replies
Asian black bear
The problem you are worried about is called session hijacking, where a malicious JS can steal the cookie then present whatever token elsewhere to impersonate the user.
The doc is saying that supabase's client side library needs to see the cookie to work, so using http only cookies is not really a viable mitigation.
Asian black bear
Presumably they have some other mitigation in their service or library, although the most effective one is to simply not include un-trusted JS on your site as it could impersonate the user easily in other ways as well.
New Guinea Singing DogOP
Ohh i see thank you