I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS.
For authentication, we are using Auth0. The Auth0 documentation recommends storing the access token in localstorage.
An interceptor is then used to add this to the header of each HTTP request.
However, this answer recommends not storing any sensitive information with localstorage.
The answer is from 2011, and the author also co-wrote the OWASP HTML5 cheat sheet, which states:
Pay extra attention to “localStorage.getItem” and “setItem” calls implemented in HTML5 page. It helps in detecting when developers build solutions that put sensitive information in local storage, which is a bad practice.
I am wondering if the situation in 2017/2018 has changed. Am I OK to follow Auth0's guidelines, or should I take another approach?