add FromCookie token extractor #10
Conversation
| return cookie.Value, nil | ||
| } else { | ||
| return "", nil | ||
| } |
There was a problem hiding this comment.
The } else { can be eliminated, ala
if cookie != nil {
return cookie.Value, nil
}
return "", nil
|
I've built basically the same thing. Cookies are a reasonably common place to store JWTs in non-SPAs, and I feel like support here would be greatly appreciated. |
|
Hi Auth0 team, can you provide more context as to why this isn't merged? This feels like a pretty common use case (e.g. read from cookie, if it's not there read the |
|
I agree with @donatj and @alokedesai . Authorization header is not always the best place to put the token, even for SPA application, because it is vulnerable to XSS exploit. With http-only cookies, token are vulnerable to CSRF attacks only, but on my opinion, that's easier secure with a simple CSRF token. In that configuration, the token itself is not accessible for an attacker. |
|
I apologize that this has not been looked at or merged in. We are starting work on a v2 and would be happy to take a look at this as part of that effort. |
No description provided.