medium10 pts · first answer countsweb-securityauthentication

Where to keep a session token

You want to reduce the damage if an XSS bug lets an attacker run JavaScript on your site. Where is the session token safest?

A.In localStorage, because it survives page reloadsB.In an HttpOnly, Secure, SameSite cookie set by the serverC.In a global JavaScript variable on windowD.In sessionStorage, because it is cleared when the tab closes

Discussion 0

Join free to post in the discussion.

Where to keep a session token

Discussion 0

Related questions