Comparison
HttpOnly cookievslocalStorage
HttpOnly cookie
the session cookie is invisible to `document.cookie`, so a script that gets injected cannot read it.
A cookie flag that hides the value from JavaScript entirely, leaving it usable only by the browser when making requests. Together with `Secure`, which restricts it to HTTPS, it is the reason session tokens belong in cookies rather than in `localStorage`. It limits the damage from XSS without preventing it: injected script can still make authenticated requests as the user, it just cannot exfiltrate the token.
Full entry →localStorage
you saved the preference and it was still there a week later, on that browser only.
A synchronous key-value store of strings, scoped to the origin, with no expiry. It is convenient and it is synchronous on the main thread, which means a large read blocks rendering. It is readable by any script on the origin, so nothing sensitive belongs in it, and the accessor itself throws in some privacy modes, so every access needs wrapping.
Full entry →