Basically I am building a serverless next.js app with mongodb.
Idea 1 : React prevents most of the XSS already , so should I just store user login info in web storage ? this way I do not need to worry about CSRF.
Idea 2 : If I use httpOnly cookie based auth , since httpOnly and sameorigin already prevents XSS(and some CSRF), I can proceed with my design without worries ? do you think it is enough for a beginner eCommerce site ?
Idea 3: Add a CSRF token to the cookie based auth
- user logged in , in the /api/login, I check for username/password then generate a cookie with CSRF token in it and also res.end(CSRF). after receiving this , we store CSRF in useContext to make it available for all components.
- so whenever i fetch with POST i attach this global CSRF token to the req.body , lastly , in /api/ we compare this CSRF in the req.body with CSRF in the cookie .
is there any better ideas for serverless app ? or am i missing something ? what do you recommend ?
idea 4: use CSRF built-in framework like express.js ....
UPDATED : next-auth is supported , but i want to learn about auth so really want to build on on my own