DEV Community

Discussion on: Difference Between Web Storage Types

Collapse
 
odedw profile image
Oded Welgreen

Local storage is not recommended for saving authentication tokens. Cookies have the advantage of setting the 'httponly' flag, which means client side code cannot access the value. This can help mitigate the risk of some XSS attacks.
Some more information:
auth0.com/docs/security/store-tokens
owasp.org/index.php/HttpOnly