ronnieroyston commented on issue #2873: URL: https://github.com/apache/couchdb/issues/2873#issuecomment-1616316141
I second this motion. It is said to be best practice to issue JWT's as HTTPOnly cookies meaning that they are not available to client/browser JavaScript. In other words, it is impossible to build a custom header aligning with CouchDB's interface, namely `Authorization: Bearer <JWT token>` https://docs.couchdb.org/en/stable/api/server/authn.html#jwt-authentication RFC 6265, HTTP State Management Mechanism [Section 4.1.2.6. The HttpOnly Attribute](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.6) The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via "non-HTTP" APIs (such as a web browser API that exposes cookies to scripts). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
