advancedSpring Security
Where should you store JWT tokens on the client side? What are the security tradeoffs?
localStorage/sessionStorage are readable by any JS on the page (XSS-vulnerable). An HttpOnly cookie is safe from XSS but vulnerable to CSRF unless mitigated with SameSite=Strict/Lax or a CSRF token. Common best practice: keep the access token only in memory (a JS variable) and put the refresh token in an HttpOnly cookie.
This is a Pro question
Sign in, then upgrade to Pro or Power to unlock this question and the full Interview Prep bank.
Where should you store JWT tokens on the client side? What are the security tradeoffs?