Which storage mechanism is safest for an authentication token?
- A localStorage
- B sessionStorage
- C An httpOnly cookie
- D A global JavaScript variable
Answer
An httpOnly cookie
An httpOnly cookie cannot be read by JavaScript, so a single XSS flaw does not expose the session. Adding secure and sameSite strengthens it further.





