Browser & Web Performance · Junior · Question 68 of 75

Why is storing an auth token in `localStorage` considered risky?

✓Correct answer: Any script running on the page, including injected XSS, can read it
2localStorage is cleared every time the tab closes
3localStorage is sent to every server on each request

Explanation

localStorage has no HttpOnly equivalent. An HttpOnly, Secure, SameSite cookie keeps the token out of reach of JS.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.