Document Spartacus security precautions
Open
@dunqan is already working on this.
Since Jun 19, 2019.
- Dominant language
- HTML
- Stars
- 11
- Forks
- 22
- Avg merge
- 7d 3h
- Merged PRs (30d)
- 2
Description
Document security concerns for Spartacus
- Session token removal
- Security implications of user token stored in local storage
- XSRF tokens in angular
It's supported by default in Angular (if HttpClient is used, and we use it exclusively) but requires proper support on the backend and additional deployment measurements.
More info about Angular support: https://angular.io/guide/security#xsrf
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.