FrontendHaltSecurity·Intermediate·Conceptual·1 min read
Should authentication tokens be stored in localStorage?
Short interview answer
There is no universal answer, but localStorage is readable by any script executing in the origin, so XSS can steal persistent tokens. HttpOnly secure cookies reduce direct token theft but require CSRF design. The architecture should minimize token exposure, lifetime, and privilege.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.