J
jeremy
16 minutes
Why Keeping a Token in localStorage Invites Cross-Site Scripting Theft
Anything in localStorage is readable by any JavaScript running on your page, including a script that slipped in through a comment field or a compromised dependency. A credential in an HttpOnly cookie is not readable by that script at all, so the same bug steals nothing. This is the main reason browser apps are steered towards cookies even when the backend speaks tokens.