Question

ChatGPT suggested storing JWT in localStorage, is that bad?

Solved · 295 viewsasked last week by

kai_makes

It says it's simpler than cookies. My gut says no.

What I’ve tried

Read two articles that contradict each other.

Comment

What's the stack? If it's Supabase, the ssr package already stores the session in cookies and you don't need to handle the token yourself.

amir_h last week

Next.js + Supabase.

kai_makes last week

2 answers

Marked as helpful by the asker

lena_opslast week

Your gut is right for most apps. localStorage is readable by any script on the page, so one XSS hole means stolen sessions. HttpOnly cookies are not. Supabase's @supabase/ssr and Auth.js both do cookies for you; use the default instead of inventing the storage layer.

Comment

sven_fire7 days ago

The one case for tokens in JS: a pure SPA calling a third-party API with short-lived tokens. That is not your app.

Comment

Agreed, and even then keep them in memory, not in localStorage.

lena_ops 7 days ago

Keyboard shortcuts

ChatGPT suggested storing JWT in localStorage, is that bad?

What I’ve tried

2 answers

Your answer

ChatGPT suggested storing JWT in localStorage, is that bad?

What I’ve tried

2 answers

Related

Your answer