Where you store tokens affects security.
localStorage:
- Persistent across sessions
- Accessible to all JavaScript (XSS vulnerable)
- Not sent automatically with requests
sessionStorage:
- Cleared when tab closes
- Same XSS risk as localStorage
HttpOnly cookies:
- Not accessible to JavaScript (XSS protected)
- Sent automatically (CSRF risk, mitigate with tokens)
- Better choice for authentication tokens
Interview tip: Prefer HttpOnly cookies for auth tokens. Discuss XSS vs CSRF tradeoffs.