Is localStorage a security liability for JWTs?

Question

I'm using JSON web tokens for authentication in my app. Since data is pulled from protected routes in the API, security tokens are stored in the frontend.

My question is this: Is using HTML's localStorage to store JWTs (nothing else) an unsafe option compared to cookies? I understand cookies have their own disadvantages, but I'm looking for the safest way available to store a JWT locally.

Answer 1

localStorage should never be used for storing any sensitive data; if you absolutely must use something other than cookies, use at least only sessionStorage instead, which is only available to that window/tab until the window is closed.

• You cannot control the expiration time like you can do with cookies.

• A single XSS vulnerability can be used to steal all the information from data inside localStorage, also it persists when you close the tab.

• localStorage doesn't have any options to restrict the visibility of an object to a specific path like with the attribute path of HTTP Cookies. Cookies are ideal because you have much more control over them: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie You can specify a number of attributes/flags, like: Secure, HttpOnly, SameSite, HostOnly.

• It wasn't designed as a secure storage mechanism, and it's implementation can vary from browser to browser.

• There is no way to restrict script-access to information stored in localStorage, which is possible with the HttpOnly attribute for cookies.

• Cookies are stored encrypted on the client computer, unlike data in local storage.

OWASP strongly advises to never use local storage for storing any sensitive information:

Any authentication your application requires can be bypassed by a user with local privileges to the machine on which the data is stored. Therefore, it's recommended not to store any sensitive information in local storage.

JWTs are highly sensitive data. Not only because they act as tokens for authentication, but they also very often contain sensitive data like email/username, roles, etc. only base64-encoded (although best practice is to avoid that). So they are often still to be considered sensitive data even when they are not valid anymore.

I recommend to read the corresponding section in OWASP's HTML5 Security Cheat Sheet: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTML5_Security_Cheat_Sheet.md

An interesting read about the topic can be found at: https://dev.to/rdegges/please-stop-using-local-storage-1i04

Answer 2

Using localStorage is no less safe than using cookies, with two exceptions:

1. It's possible to set cookies as HTTPOnly, but then they'd be unusable from JavaScript, which in this case would defeat the purpose).
2. There's no equivalent of a cookie's "path" for localStorage, but this would only matter if you're running untrusted code in the same origin anyway, which invalidates pretty much every security guarantee.

In fact, localStorage may even be safer, as it isn't sent to the server automatically with each request, which means there's no ambient authentication, and thus less risk of CSRF.