Just to be clear, I'm not a security expert in any way, just learned myself while building things. So here is what I'd refer to: https://stackoverflow.com/que

Just to be clear, I'm not a security expert in any way, just learned myself while building things. So here is what I'd refer to: https://stackoverflow.com/questions/44133536/is-it-safe-to-store-a-jwt-in-localstorage-with-reactjs https://stackoverflow.com/questions/44133536/is-it-safe-to-s... Regarding the Firebase, I see an open issue on this, so I guess we are not the only ones wondering :) https://github.com/firebase/quickstart-nodejs/issues/194 https://github.com/firebase/quickstart-nodejs/issues/194