The truth about cookies, tokens and APIs

With the rise of Single Page Applications, we also see a paradigm shift in session management techniques. Instead of using server-side cookie-based sessions, many developers are shifting towards client-side state mechanisms, using JWT tokens an custo...

With the rise of Single Page Applications, we also see a paradigm shift in session management techniques. Instead of using server-side cookie-based sessions, many developers are shifting towards client-side state mechanisms, using JWT tokens an custom HTTP headers. There’s plenty of conflicting advice out there, discussing cookie security issues, Cross-Site Request Forgery, and XSS. So how can you make a sensible choice, and how will that impact the security of your application?

This talk will guide you in this choice. We dive into the technicalities behind these technologies, and the actual security impact of your choices. We’ll look at compatibility with current web security mechanisms. You will learn how to assess your past choices, and how to substantiate future decisions.

Speaker:

Philippe De Ryck
Pragmatic Web Security
Founder

I am the founder of Pragmatic Web Security, where I travel the world to train developers on web security and security engineering. I hold a Ph.D. in web security from KU Leuven. Google recognizes me as a Google Developer Expert for my knowledge of web security and security in Angular applications. Screen reader support enabled.