Reputation: 495
I'm currently using cookies
to store my employee_id
. This employee_id
is needed as a params
to one of my list in the navigation menu that will redirect them to a private page /private/:id
. I read that users can edit browser cookies, thus can see other employee's private page.
I also tried vuex and sessions storage.
setEmployeeID
function in created()
so even if the user refreshes, the data won't disappear since it is always using axios call to get the id?Upvotes: 1
Views: 501
Reputation: 2060
Everything that gets to the client can be edited / viewed, including cookies, storage, etc.
If you have some info that you don't want to be exposed to another users - store it on server and do authentication. Do it using Vuex and you will be fine.
Session storage - is per tab and destroyed when the tab destroyed
Cookies - here is explanation regarding cookies securing: https://blog.dareboost.com/en/2019/03/secure-cookies-secure-httponly-flags/
Upvotes: 2