Web Security · Senior · Question 30 of 75
Tokens kept only in memory in a SPA vs HttpOnly cookies: what's the key trade-off?
- 1Memory is always safe, cookies are always unsafe
- ✓Correct answer: In memory, XSS can still use or steal tokens but CSRF isn't an issue; cookies hide the token but need CSRF protection
- 3There is no difference
Explanation
Neither option survives XSS fully: the attacker can act in the page either way. The real difference is whether a token can be taken and used elsewhere.