8.2.2 improvement, closes #1091

[elarlang]

This Pull Request relates to issue #1091

[jmanico]

Can we clean this up just a little before merging? "cookie-based session tokens in cookies" is redundant.

So can we go from:

Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of cookie-based session tokens in cookies and token-based session tokens in sessionStorage.

to

Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of cookie-based session tokens and token-based session tokens in sessionStorage.

[elarlang]

Do you wnat to change the meaning to "cookie-based session tokens are allowed to be stored in sessionStorage"?

This is not true and this is not the goal for/from me. The point for the exception:

• cookie-based session tokens are allowed to be stored browser storage, but ONLY in cookies
• token-based session tokens are allowed to be stored browser storage, but ONLY in sessionStorage

But not cookie-based session tokens in sessionStorage

[jmanico]

All I am saying is that the phrase“ cookie-based session tokens in cookies” is redundant.

[elarlang]

I don't agree, without this phrase the meaning is different. If we can not agree on this or it's not clear like it is, we just need to drop this PR and come with new solution.

[jmanico]

Where else would a cookie-based session be stored in a browser? I am confused...

It is implicit that a "cookie-based session" is stored in a cookie.

[jmanico]

Hey @tghosth and/or @danielcuthbert can you please take a look at this?

[elarlang]

Where else would a cookie-based session be stored in a browser? I am confused...

It is implicit that a "cookie-based session" is stored in a cookie.

And this is precisely the reason why we need to make it clear - that for cookie-based session token it is allowed to store the token ONLY in cookies, and do not send it to DOM, store in sessionStorage etc.

I added requirement V3.4.6 and without saying it/duplicate again in 8.2.2, it is in conflict with 3.4.6.

If needed, please go through all the discussion in monster issue which lead me to make this proposal:
#843 (comment)

[jmanico]

I went through all of the threads. I agree with with thew spirit of this requirement. My concern is that the use the term /cookie/ twice in a sentence like this is just bad English and it reads poorly. I'd like other leads to chime in before we merge this.