WHERE TO STORE JWTS

Summary from the TLDR InfoSec newsletter

This post breaks down the pros and cons of storing JWT tokens in cookies vs Session/Local Storage. Neither option is completely secure. Cookies used with HttpOnly are protected from JavaScript but they are vulnerable to CSRF and can be used in XSS attacks because the browser will send them on every request. Session and Local Storage are not vulnerable to CSRF but are designed to be accessed from JavaScript and are also vulnerable to XSS. Session Storage is per-tab, so users that open a link in a new tab will be logged out in that tab.