24 lines
1.4 KiB
Markdown
24 lines
1.4 KiB
Markdown
# Requirements Clarification Questions — CMS Frontend
|
|
|
|
I detected a contradiction in your responses that needs clarification:
|
|
|
|
## Contradiction: Authentication Security vs. Security Baseline
|
|
|
|
You indicated **JWT in localStorage** (Q2: A) but also **Enforce all SECURITY rules as blocking constraints** (Q11: A).
|
|
|
|
Storing JWT tokens in `localStorage` is a known security vulnerability — XSS attacks can steal tokens from localStorage. When the Security Baseline extension is enforced, this pattern is typically flagged as a **blocking security finding**.
|
|
|
|
This means either:
|
|
- The security baseline must be applied → the localStorage auth approach cannot be used
|
|
- The localStorage auth approach is acceptable → security baseline must be relaxed or skipped
|
|
|
|
### Clarification Question 1
|
|
How should this contradiction be resolved for the cms-frontend project?
|
|
|
|
A) Use a secure authentication approach (access token in memory + refresh token in httpOnly cookie) AND keep the security baseline enforced — this is the secure production-ready choice
|
|
B) Keep localStorage for now (faster to implement, familiar) AND disable the security baseline — acceptable for a prototype/development phase
|
|
C) Keep localStorage for now AND keep the security baseline, but acknowledge and document this as an accepted risk / technical debt
|
|
X) Other (please describe after [Answer]: tag below)
|
|
|
|
[Answer]: A
|