System Design · Middle · Question 13 of 75

Where is it safer to store a session token in the browser?

Explanation

An HttpOnly cookie is inaccessible to scripts, so XSS can't steal it directly. SameSite reduces CSRF risk, Secure means HTTPS only. A token in localStorage can be read by any injected script. There's no fully safe storage under XSS - XSS protection is mandatory.

Further reading

Problem with a question

System Design · Middle · question 13

Test yourself

Take the System Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.

Take this quiz