Question

ChatGPT suggested storing JWT in localStorage, is that bad?

Solved · 5 views · asked last week by kai_makes · edited

It says it's simpler than cookies. My gut says no.

What I’ve tried

Read two articles that contradict each other.

Comment

2 answers

Marked as helpful by the asker

lena_opslast week · edited

Your gut is right for most apps. localStorage is readable by any script on the page, so one XSS hole means stolen sessions. HttpOnly cookies are not. Supabase's @supabase/ssr and Auth.js both do cookies for you; use the default instead of inventing the storage layer.

Comment

sven_firelast week · edited

The one case for tokens in JS: a pure SPA calling a third-party API with short-lived tokens. That is not your app.

Comment

Keyboard shortcuts

ChatGPT suggested storing JWT in localStorage, is that bad?

What I’ve tried

2 answers

Your answer