1.4 KiB
Requirements Clarification Questions — CMS Frontend
I detected a contradiction in your responses that needs clarification:
Contradiction: Authentication Security vs. Security Baseline
You indicated JWT in localStorage (Q2: A) but also Enforce all SECURITY rules as blocking constraints (Q11: A).
Storing JWT tokens in localStorage is a known security vulnerability — XSS attacks can steal tokens from localStorage. When the Security Baseline extension is enforced, this pattern is typically flagged as a blocking security finding.
This means either:
- The security baseline must be applied → the localStorage auth approach cannot be used
- The localStorage auth approach is acceptable → security baseline must be relaxed or skipped
Clarification Question 1
How should this contradiction be resolved for the cms-frontend project?
A) Use a secure authentication approach (access token in memory + refresh token in httpOnly cookie) AND keep the security baseline enforced — this is the secure production-ready choice B) Keep localStorage for now (faster to implement, familiar) AND disable the security baseline — acceptable for a prototype/development phase C) Keep localStorage for now AND keep the security baseline, but acknowledge and document this as an accepted risk / technical debt X) Other (please describe after [Answer]: tag below)
[Answer]: