4 ms·
Can you confirm that you don’t recommend storing session tokens in localStorage / anything accessible by client-side JS? (It’s a commonly recommended bad practi
by timwis 6y ago
Can you confirm that you don’t recommend storing session tokens in localStorage / anything accessible by client-side JS? (It’s a commonly recommended bad practice these days)
- advaitruia 6y agoYes, we do not recommend storing tokens in localstorage. This is also recommended by other security bodies such as OWASP and NIST. We've written a blog post on this topic as well, that you can read here: https://supertokens.io/blog/cookies-vs-localstorage-for-sessions-everything-you-need-to-know https://supertokens.io/blog/cookies-vs-localstorage-for-sess...
- timwis 6y agoGreat! Pleased to see this :)