Local storage shouldn't be used to store sensitive data. It's unsafe!. Tagged with programming, security, javascript.

Materialize

Bobby Iliev

DevOps

Community Picks is a section on daily.dev where our community members share the most interesting and valuable content they've discovered online. From insightful articles to handy tools, every post is a gem curated by our dedicated coomunity. To contribute to Community Picks, you need to have at least 250 reputation points, ensuring that only active and trusted members can share their finds.

Community Picks

Local storage is just one big old JavaScript object that you can attach data to (or remove data from) Local storage provides at least 5MB of data storage across all major web browsers. This is a fairly low limit for people building apps that are data intensive or need to function offline. If the app you're using doesn't fit the above description: don't use local storage.

Please Stop Using Local Storage

Why Local Storage is Insecure and You Shouldn't Use it to Store Sensitive Data

PSA: Don't Store JSON Web Tokens in Local Storage

I’ve read the article and is quite funny.
But, the comment section is more informative than the whole article!
Especially this: <a href="https://dev.to/jondubois/comment/373l" target="_blank" rel="noopener nofollow">https://dev.to/jondubois/comment/373l</a>
And there is more important info. The article itself is okay but not 100% true. But with the comments, you will understand the problems. Tl;dr; choose wisely what to use, everything has security issues.

I think this article is missing one of the important part of a JWT, which is not having to hit a DB/Cache for each verification…
I get that the author is concerned about security, but suggesting some “always”/“never” rule is not good in general
Everything is always a trade of between security and performance and when choosing your strategy you need to put in place all the necessary steps to secure your solution, which means that if you opt for local storage, then put your focus in preventing XSS from happening

I like how the comments roast the author