Contents
Although cookies still have some vulnerabilities, it’s preferable compared to localStorage whenever possible. Both localStorage and cookies are vulnerable to XSS attacks but it’s harder for the attacker to do the attack when you’re using httpOnly cookies.
They are used to store data in the browser. They are accessible from the client-side only (web servers can’t access them directly). Unlike Cookies where all Cookies (for that domain) are sent on each request, Local and Session Storage data aren’t sent on each HTTP request.
Why are my cookies over localStorage?
A JWT needs to be stored in a safe place inside the user’s browser. To keep them secure, you should always store JWTs inside an httpOnly cookie. This is a special kind of cookie that’s only sent in HTTP requests to the server. It’s never accessible (both for reading or writing) from JavaScript running in the browser.
Compared to cookie, HTML 5 web storage has many advantages. Size is not limited to < 4 kb , web storage can use 5 mb of space. Web storage not sending the data to server with each server calls, this will improve the sit performance. improved security. There are two different methods to store data in browser using web storage.
What is the difference between local storage and cookies?
On client and server, the following storages are available: local storage, session storage, and cookies. The Local Storage is designed for storage that spans multiple windows and lasts beyond the current session.
Both cookies and localstorage are accessed via JavaScript APIs. When the attacker can inject JavaScript into the target’s html document, they can read and write them equally. A comment mentions http-only cookies.
CSRF attacks will have Referer and Origin headers that are unrelated to your application. The full article can be found here: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage/