This article discusses storing session tokens in a cookie vs in localStorage: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/
The article states:
The end of the article states:
Stormpath recommends that you store your JWT in cookies for web applications... HTML5 Web Storage is vulnerable to XSS...
Aren't cookies and localStorage both vulnerable to XSS? With cookies, the attacker can't fetch the cookie and store it, but that's not necessary anyway if you can authenticate using the cookie.