Where should you store a JWT in the browser?
Model answer
localStorage is easy but any XSS flaw can steal the token. An HttpOnly, Secure, SameSite cookie cannot be read by JavaScript, which is safer against XSS, but then you need CSRF protection. Many teams use short-lived access tokens, a refresh token in an HttpOnly cookie, and strict XSS prevention.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.