ASP.NET Core Web API Interview Question #68
Should JWT access tokens be stored in localStorage?
Authentication, Authorization, JWT & API Security Mid-Level Intermediate
Quick Interview Answer
There is no universally correct browser storage choice because the security trade-offs depend on the architecture. JavaScript-accessible storage such as localStorage is exposed if an attacker achieves script execution through XSS.
Detailed Explanation
There is no universally correct browser storage choice because the security trade-offs depend on the architecture. JavaScript-accessible storage such as localStorage is exposed if an attacker achieves script execution through XSS.
Secure HttpOnly cookies prevent JavaScript from reading the token but introduce browser cookie and CSRF considerations. For browser applications, choose an established authentication architecture and threat model rather than selecting storage solely for convenience.
Code Example
// HttpOnly cookies cannot be read by JavaScript.
// JavaScript-accessible token storage requires strong XSS defenses.
// The correct design depends on the client architecture
// and identity flow.