Re: [I] Clear JWT token and CSRF token from DOM on session end / timeout (ASVS 14.3.1) (tooling-trusted-releases)

["alitheg (via GitHub)" <gi...@apache.org>]

alitheg commented on issue #698:
URL: https://github.com/apache/tooling-trusted-releases/issues/698#issuecomment-4022339118

   I have a question on this one - isn't clearing this up `onbeforeunload` a redundant place to do it? The DOM and JS structures on that page are torn down immediately after that event, so what benefit is there to clearing this data `onbeforeunload`?
   
   On the token display - happy to time it out, however I feel like showing a token that's generated and only killing the visibility once the user leaves the page is fairly standard practice among even identity apps (where the security is super important) - does everyone else consider this time window not an issue, or am I missing something? In either case, I can do a timeout easily enough I just want to make sure it's actually giving us something!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org