5 ms·
The article addresses part of this, if you set the cookie as httpOnly then JS cannot read the cookie. So it is harder for XSS to lead to token exfiltration if
by SahAssar 6y ago
The article addresses part of this, if you set the cookie as httpOnly then JS cannot read the cookie.
So it is harder for XSS to lead to token exfiltration if using a properly configured cookie than it is with localStorage.