Web Security · Junior · Question 48 of 75

Why is storing an access token in `localStorage` risky?

1Because localStorage is sent to the server with every request
2Because localStorage is shared between all websites
✓Correct answer: Any script on the page, including injected XSS code, can read it and send it to an attacker

Explanation

localStorage has no HttpOnly equivalent. With XSS, a stolen token can be used from the attacker's machine until it expires.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.