Js-cookie: Add input validation and tamper-proofing to README.md

[courtneyaschwartz]

I can contribute a draft PR for this if you like. Just mention me.

Might be worth reminding that JSON and URL encoding converter:
https://github.com/js-cookie/js-cookie#converters
obviously won't work if you use an external library to do the storage encryption/tamper-proofing. (Can't decode a properly encrypted string...)

In the security industry, we see a lot of cookie-related CSRF and XSS vulnerabilities due to people...

• Misunderstanding how effective HTTP Secure , SameSite, and HttpOnly is (they are mostly not)
• Not knowing how to use them
• Misunderstanding that you're not safe just because your cookie doesn't have a form (malware is mostly scripted not GUI anyways)
• Directly using input without sanitization or encryption/tamper-proofing (Hence issues #459 and #496 and https://www.chromestatus.com/feature/5633521622188032)

Many people simply Ctrl + C. Secure coding is still not widely taught. So it would help if the README can show proper use. Like a comment that reminds them to run validate.js or something on results after Cookies.get('name'), etc. That way you can still keep the shippable + dependencies small, but still encourage best practice.

No huge explainer needed about HTTP headers. Can just link to a resource:
https://web.dev/samesite-cookies-explained/

[carhartl]

Hi Courtney, in general it‘s a good idea, but the readme imo shouldn’t be the place to educate people about security best practices, and I‘m trying to keep it as dense as possible. The impression (from issues we get) I got is that people often do not read the readme/documentation and I‘m afraid it won’t get better if we add more things to it.

We do try to maintain a useful wiki, how about adding to that?

[carhartl]

Related: Chrome started to make SameSite: lax a default, might be worth to mention..

[carhartl]

@courtneyaschwartz Not sure what you had in mind though.. after rereading this it might have been adding just a bit to the converters section?

[courtneyaschwartz]

@carhartl Yes, a reminder about the new requirements about SameSite: None and converters would be good. (Like your existing reminder about InternetGetCookie and domain...)

And... This README can't possibly completely cover all of security. :) I am only suggesting a minimal hint, like your comments:

Cookies.get('foo', { domain: 'sub.example.com' }) //domainwon't have any effect...!

10% of people never read anything. We can't help that... But they'll ask experts for help. Experts learn by reading. We can help _them_.

[carhartl]

@courtneyaschwartz Cool! If you would like to send a PR with these improvements you have in mind that would be much appreciated.. thank you!

[courtneyaschwartz]

Sure, no problem. Probably tonight.