Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from the industry that lead to this. This is just a terrible idea all-round! Did everyone suddenly become so confident that they aren't susceptible to XSS attacks? The best practice for years in the security industry has been to store them in secure cookies + CSRF tokens for secure forms.

Does anyone know what could have lead to this new phenomenon?

  • 1
    I know a lot of front-end devs who can make beautiful web apps, but lack the understanding of security and things like cookies and session storage. Commented Dec 17, 2019 at 7:20
  • 3
    Could you clarify your question? If you're asking "why do people do stupid things", that's not really in scope for this website. Are you asking under what circumstances storing JWT's in localStorage is a good idea? Then you need to expand on why you think it is a security risk.
    – Sjoerd
    Commented Dec 17, 2019 at 10:38
  • To clarify, Im not asking why stupid people do stupid things. Im asking what lead to this, could it be a company avocating for session management to be done this way or what other factors could have lead to this odd occurrence. made edits to the question to make it more explicit.
    – jia chen
    Commented Dec 18, 2019 at 2:33

1 Answer 1


I have also noticed an uprising of storing JWT's in LocalStorage, but thankfully recently some developers are making articles on why not to do that.

This is a pretty broad topic and in no way I am for storing JWT tokens in LocalStorage, because your one XSS vulnerability away to get blown to bits, but the thought process behind it is pretty legit.

Two things come to mind:

  • You don't need CSRF tokens, which means less work for developers and actually makes an environment more secure on that part, because you can't make any mistakes there. Since the easy implementation of CSRF in all modern frameworks, this is no longer an issue.
  • You can simplify things on API. What you would normally do is, take the cookie after signing in, authenticate the cookie against API endpoint, grab the JWT token and store it in LocalStorage. The reason to store it in LocalStorage is so that you can access it later with Javascript to generate queries to the API with "Authorization: Bearer ey.." token from the User Interface. This simplifies things.

Please add if I missed something.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .