CS Fundamentals Trainer · JavaScript · Security

A single-page app keeps its access token in localStorage and sends it in an Authorization header. Compared with an HttpOnly; Secure;…

A single-page app keeps its access token in `localStorage` and sends it in an `Authorization` header. Compared with an `HttpOnly; Secure; SameSite=Lax` session cookie, what is the main trade-off?

  1. The header approach resists classic CSRF, but any XSS can read and exfiltrate the token; the cookie hides its value from scripts but needs CSRF defenses.
  2. The header approach resists XSS, because `localStorage` is encrypted per origin, while any script on the page can read the `HttpOnly` cookie.
  3. Both approaches behave the same for XSS and for CSRF; the real difference between them is the size limit on what they can store.
  4. The cookie can be stolen through `document.cookie` during XSS, while the header approach needs a CSRF token on each request.

Difficulty: hard

Answer this question

Related questions