René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Allow Cookie-based Sessions","articleBody":"Hi, I noticed there was a lack of cookie based session management (unless I've missed something in the docs) and since samesite attributes protect against CSRF, the recommendation against it is outdated \u003chttps://feathersjs.com/guides/security.html\u003e.\n\nAs for the stance that if an XSS vulnerability is abused you have more important things to worry about than a stolen token, this may be right, but a HttpOnly cookie still limits the window of abuse while the XSS is active, whereas if a token were to be stolen, it can be used until its expiry. I think in most cases a HttpOnly, SameSite cookie is safer than a local storage implementation, and even if not, I think it would be nice to have a built-in securely configured cookie option for devs to easily choose from for themselves.","author":{"url":"https://github.com/KevinB-Adappt","@type":"Person","name":"KevinB-Adappt"},"datePublished":"2025-11-05T23:26:59.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/3628/feathers/issues/3628"}