I've had arguments with people storing session tokens in local storage and claiming it is perfectly safe. Not marking the cookie httpOnly ironically doesn't su

I've had arguments with people storing session tokens in local storage and claiming it is perfectly safe. Not marking the cookie httpOnly ironically doesn't surprise me. TLDR: if you aren't going to look up the very basics of security just use a trusted library