Howtographql: Security of localStorage with JWT

[sedubois]

Hi and thanks for offering all this to learn and get faster into coding GraphQL!

A colleague drew my attention to the fact that these tutorials invite the user to store JWT tokens in localStorage:

localStorage.setItem(AUTH_TOKEN, token)

According to this article, localStorage is subject to XSS and should never be used to store authentication tokens:

please, please, whatever you do, do not store session information (like JSON Web Tokens) in local storage. This is a very bad idea and will open you up to an extremely wide array of attacks that could absolutely cripple your users.

Do you agree with this? Could the tutorials be updated to use secure cookies? I would love to have that info, otherwise I probably can't rely on these tutorials to learn the full stack. I also think it's important to educate everyone to secure practices. Thanks a lot 😊

[nikolasburk]

Hi @sedubois,

thanks a lot for bringing this up! We definitely agree with the statements in the article that storing JWTs in localStorage is not the safest approach. I've just added a corresponding note to the tutorial to warn the reader about this, and that in production they should probably choose a different authentication mechanism.

However, we're not going to update the actual code for the tutorial to keep things simple. The tutorials are strongly focussed on teaching GraphQL & Apollo, so we want to keep the distractions to a minimum. Does that make sense to you?

[sedubois]

Thanks @nikolasburk, I understand if authentication is deemed out of scope as you need to focus on other things. But in that case it should IMHO be removed from the tutorial. Leaving the code as it is is leading people in a wrong and insecure direction, even if there is a warning.

Of course it would be super awesome if the turorial showed how to have secure auth, because it’s really hard to come by (I still haven’t found a proper tutorial). So it might add a lot of value to your full stack tutorial, if you somehow find the resources to change this.

[sunapi386]

@nikolasburk I understand the focus of this tutorial is to teach GraphQL & Apollo, and I applaud you guys for the effort to write a chapter on authentication (on backend/frontend tutorials). With the vastly different scopes to cover, I think glossing over some details is correct.

But as @sedubois said, it is hard to find a secure auth tutorial that does it correctly. If anyone finds a link, please put it here.

I humbly think perhaps it's worth keeping this on the to-do list. If someone in the future writes a pull request and adds that here, or a blog, that would be superb.

[swcarlosrj]

Thanks @sedubois for opening this issue 😄Closing this due to inactivity!