It’s the default in half the SPA tutorials out there, and it’s an XSS jackpot. Any script that runs on your page — a compromised npm dep, a bad third-party tag — can read localStorage and walk away with the token.
httpOnly cookies fix the theft vector: JavaScript literally can’t read them. Yes, you take on CSRF instead — but CSRF has clean, well-understood defenses (SameSite, tokens). XSS-stealing a bearer token does not.
“But cookies are old-school” isn’t a threat model.
Where do you land — httpOnly cookies or localStorage with a short TTL and hope?
Full breakdown → <a href="https://www.alekseialeinikov.com/en/blog/topics/security/stop-storing-jwts-in-localstorage-cookie-auth-for-spas-2026" target="_blank" rel="noopener nofollow">https://www.alekseialeinikov.com/en/blog/topics/security/stop-storing-jwts-in-localstorage-cookie-auth-for-spas-2026</a>

GKE security, platform engineering, and Google Cloud deep-dives — hands-on notes from building production cloud platforms. EN + DE.

Aleksei Aleinikov — Cloud & Platform Engineering

Storing JWTs in localStorage exposes them to XSS attacks — any malicious script on the page can steal the token. httpOnly cookies prevent JavaScript from reading the token at all, eliminating that theft vector. While httpOnly cookies introduce CSRF risk, that attack has well-understood mitigations like SameSite and CSRF tokens. The post argues that 'cookies are old-school' is not a valid security argument, and advocates for httpOnly cookies over localStorage for SPA authentication.

Stop storing JWTs in localStorage