Both the creators of the JWT standard and OWASP say not to store tokens in local storage as it makes your site vulnerable to cross-site-scripting, yet you store the JWT tokens in local storage (jwt-react/src/api/auth.js).
I'm looking to implement something like this and haven't found a good alternative yet (maybe HTTP cookies but then you need to address CSRF). I'm curious how this could be addressed.
Both the creators of the JWT standard and OWASP say not to store tokens in local storage as it makes your site vulnerable to cross-site-scripting, yet you store the JWT tokens in local storage (
jwt-react/src/api/auth.js).I'm looking to implement something like this and haven't found a good alternative yet (maybe HTTP cookies but then you need to address CSRF). I'm curious how this could be addressed.