Yes, we do not recommend storing tokens in localstorage. This is also recommended by other security bodies such as OWASP and NIST. We've written a blog post on

Yes, we do not recommend storing tokens in localstorage. This is also recommended by other security bodies such as OWASP and NIST. We've written a blog post on this topic as well, that you can read here: https://supertokens.io/blog/cookies-vs-localstorage-for-sessions-everything-you-need-to-know https://supertokens.io/blog/cookies-vs-localstorage-for-sess...