Major security flaw - loadFromCookie

There seems to be a major security flaw when using client.authStore.loadFromCookie(). The cookie value is clear text and can easily be changed. loadFromCookie() set the model data from the cookie value without validating anything (except that the token is not expired).

That means you can never trust client.authStore.model even if client.authStore.valid returns true.

I think it would be far better to use a jwt with the desired model data as the cookie value and do really verify the token (not just the expire date).

[ganigeorgiev]

I’ve updated the examples and I’ve added a note in the loadFromCookie jsdoc that you may need to call authRefresh() in order to trust the isValid call. It is published as a new v0.8.1 release so that the docs changes are available on autocomplete and in the npm package readme.

[PatrickG]

@PatrickG I’ve created a PR in the tutorial repo - huntabyte/projecthunt#4.

If you aware of other tutorials feel free to post them here or directly file a PR/issue in the authors repo.

Thank you. I’ve created the same pr for another repo. I hope it is okay that i copied your text for this 😃

If you search for pocketbase loadFromCookie, there are many projects that make this mistake. I’ve no time to check all/report it to all.