Storing arbitrary data in a cookie isn't a secure best-practice anyway. You shouldn't store actual data in cookies, just a meaningless token (aka session-id) th

Storing arbitrary data in a cookie isn't a secure best-practice anyway. You shouldn't store actual data in cookies, just a meaningless token (aka session-id) that is used to look up session data on the server side. If you insist on using local storage, please be aware that it's unsuitable for storage of any sensitive data for the same security reasons that the httponly cookie flag exists. Don't let your API elegance preferences be the only factor in your architecture design choices. Please consider security too as you may be putting your users at risk. Design choices in this area are more nuanced than you seem to be aware of.