If you're using JWTs for authentication. It's considered insecure to store them in local storage for XSS etc Where / how are you storing them locally for head

If you're using JWTs for authentication. It's considered insecure to store them in local storage for XSS etc Where / how are you storing them locally for headless apps?