Security audit

Session tokens readable in the browser

4 checks · 1 findings · scope: page, site

Audit id: security.tokens_in_browser.

Checks

Login token has no signature jwt_alg_none
Login token never expires jwt_without_expiry
Login token lasts too long jwt_lifetime_too_long
Login token kept in browser storage auth_token_in_web_storage

Findings

A JSON Web Token in the browser is unsigned, never expires, lives long, or sits in web storage