Skip to content

Commit f38b0ba

Browse files
committed
bump for deploy
1 parent ea2a4db commit f38b0ba

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

draft-ietf-oauth-browser-based-apps.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ An additional concern with handling access tokens in a browser is that
239239
in case of successful XSS attack, tokens could be read and further used or transmitted by the injected code if no
240240
secure storage mechanism is in place.
241241

242-
It could as such be considered to use an HTTP-only cookie between the JavaScript application
242+
As such, it could be considered to use an HTTP-only cookie between the JavaScript application
243243
and API so that the JavaScript code can't access the cookie value itself. The `Secure` cookie attribute should be used to ensure the cookie is not included in unencrypted HTTP requests. Additionally, the `SameSite` cookie attribute can be used to counter some CSRF attacks,
244244
but should not be considered the extent of the CSRF protection, as described in {{draft-ietf-httpbis-rfc6265bis}}
245245

0 commit comments

Comments
 (0)