FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
Why is storing an auth token in localStorage a common security concern?
Short interview answer
Any script executing in that origin, including an injected XSS payload, can read localStorage directly. There is no equivalent to a cookie's HttpOnly flag for localStorage.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.