Comment Comment by arkadiyt Hard to say without more concrete details, but if I had to reply in broad strokes:- For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1]- For web, deploy a preloaded Strict-Transport-Security header [2]- For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over port 80 revoke that token).- If you go with OpenID/Oauth for client sign-ins then require https callbacks and provide scoped permissions.- Don't use JWT [3]. Don't use CORS [4].Again these are broad strokes - if you gave more information you'd get a better response.[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...[3]: https://en.wikipedia.org/wiki/JSON_Web_Token[4]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS parent arkadiyt 7 years ago
- For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1]
- For web, deploy a preloaded Strict-Transport-Security header [2]
- For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over port 80 revoke that token).
- If you go with OpenID/Oauth for client sign-ins then require https callbacks and provide scoped permissions.
- Don't use JWT [3]. Don't use CORS [4].
Again these are broad strokes - if you gave more information you'd get a better response.
[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...
[3]: https://en.wikipedia.org/wiki/JSON_Web_Token
[4]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS