All 16 Authentication & Authorization (Identity, JWT, OAuth) questions
More in Authentication & Authorization (Identity, JWT, OAuth)
What is ASP.NET Core Identity, and what does it provide out of the box? How do you implement role-based authorization using the [Authorize(Roles = "...")] attribute? How do refresh tokens work alongside short-lived access tokens, and why is this pattern used? What is the OAuth 2.0 Client Credentials flow, and when is it used instead of the Authorization Code flow? What is the purpose of the 'scope' parameter in OAuth 2.0, and how does it implement the principle of least privilege? What are JWT claims, and how do you add custom claims when issuing a token? How does the OAuth 2.0 Authorization Code flow work, and why is it preferred over the deprecated Implicit flow for web applications? How do you implement policy-based authorization for more complex, custom access rules beyond simple roles? How does token revocation work with stateless JWTs, given they can't simply be 'deleted' server-side once issued? How does ASP.NET Core support multiple authentication schemes simultaneously (e.g., cookies for a web UI and JWT for an API in the same application)?
Advertisement
.NET › Authentication & Authorization (Identity, JWT, OAuth)

What are the security risks of storing JWTs in browser localStorage versus HttpOnly cookies?

Intermediate

Answer

Tokens in localStorage are accessible to any JavaScript running on the page, making them vulnerable to theft via XSS (cross-site scripting) attacks -- a single injected malicious script can read and exfiltrate the token. HttpOnly cookies are inaccessible to JavaScript entirely, protecting against XSS token theft, but introduce CSRF (cross-site request forgery) risk instead, requiring anti-forgery tokens or SameSite cookie attributes as mitigation.
// Vulnerable to XSS if an attacker injects a script:
localStorage.setItem('token', jwt);  // any XSS payload can steal this

// HttpOnly cookie: JavaScript cannot read it at all
Response.Cookies.Append("auth_token", jwt, new CookieOptions {
    HttpOnly = true, Secure = true, SameSite = SameSiteMode.Strict
});
Real-world example A security review flags a single-page application storing JWTs in localStorage as a critical risk given the app also loads several third-party analytics scripts, recommending a move to HttpOnly cookies with CSRF protection instead.

Common follow-ups: How does SameSite=Strict mitigate CSRF risk for cookie-stored tokens?;What's the recommended pattern for SPAs needing both XSS and CSRF protection?

CORS & Cross-Origin Resource Sharing;Global Exception Handling & Middleware
All 16 Authentication & Authorization (Identity, JWT, OAuth) questions