Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from the industry that lead to this. This is just a terrible idea all-round! Did everyone suddenly become so confident that they aren't susceptible to XSS attacks? The best practice for years in the security industry has been to store them in secure cookies + CSRF tokens for secure forms.
Does anyone know what could have lead to this new phenomenon?