All 15 Authentication & Authorization questions
More in Authentication & Authorization
What is the difference between authentication and authorization in a Node.js application? How should passwords be securely stored in a Node.js application's database, and why is bcrypt commonly used? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is a JSON Web Token (JWT), and what are its three parts? What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token?
Advertisement
Node.js › Authentication & Authorization

What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective?

Beginner

Answer

A token in localStorage is accessible to any JavaScript running on the page, meaning a successful XSS (Cross-Site Scripting) attack can trivially steal it and exfiltrate it to an attacker. An httpOnly cookie is inaccessible to JavaScript entirely (the browser enforces this at the API level), making it immune to token theft via XSS, though cookies bring their own separate consideration around CSRF protection, which is why httpOnly cookies are generally the more secure default for browser-based session or token storage.
// Setting an httpOnly cookie server-side (JavaScript on the page can never read this)
res.cookie('accessToken', token, {
  httpOnly: true,
  secure: true, // only sent over HTTPS
  sameSite: 'strict',
});
Real-world example A single-page application initially stored its JWT in localStorage for simplicity, but after a security review moved to httpOnly cookies specifically to eliminate the token-theft risk from a class of XSS vulnerabilities the team couldn't fully rule out across a large, frequently-updated frontend codebase.

Common follow-ups: Given httpOnly cookies protect against XSS token theft, what protects against the corresponding CSRF risk they introduce?;Is there a legitimate reason a team might still choose localStorage despite this tradeoff?

Security;HTTP & HTTPS Modules
All 15 Authentication & Authorization questions