Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

ChatGPT suggested storing JWT in localStorage, is that bad?

Solved · 295 views · asked by kai_makes · edited
chatgptauthsecurity

It says it's simpler than cookies. My gut says no.

What I’ve tried

Read two articles that contradict each other.

Comment
What's the stack? If it's Supabase, the ssr package already stores the session in cookies and you don't need to handle the token yourself. amir_h · edited
Next.js + Supabase. kai_makes · edited

2 answers

Marked as helpful by the asker
lena_ops · edited

Your gut is right for most apps. localStorage is readable by any script on the page, so one XSS hole means stolen sessions. HttpOnly cookies are not. Supabase's @supabase/ssr and Auth.js both do cookies for you; use the default instead of inventing the storage layer.

Comment
sven_fire · edited

The one case for tokens in JS: a pure SPA calling a third-party API with short-lived tokens. That is not your app.

Comment
Agreed, and even then keep them in memory, not in localStorage. lena_ops · edited

Related

Hundreds of fake signups overnight, all with random gmail addressessolved
Google login says 'continue to xkqzjwp.supabase.co', customers think it's a scamsolved
Let people who are not logged in submit a contact form into Supabase, safely?3 ans.
Claude Code 'fixed' my permission error by turning RLS off. Is that as bad as it sounds?solved
infinite recursion detected in policy for relation "profiles"solved

Your answer

Sign in to write an answer