medium10 pts · first answer countsauthenticationsecurity

JWT in localStorage

A team stores the access token (JWT) in localStorage. What is the main security risk, and what is a common safer option?

A.Any XSS bug lets attacker JavaScript read the token; an HttpOnly, Secure cookie keeps it out of reach of scriptsB.localStorage is cleared on every page reload, so users get logged outC.JWTs are too large for localStorage, so they get cut offD.localStorage is sent with every request, which leaks the token to other sites

The N+1 query problem →