What's the best way to do authentication in modern applications

Ask ten frontend developers where to store a login token, and you'll get four answers and an argument. And because each approach addresses different concerns, the debates continue without resolution. So let's clarify once and for all: What are the options to store a token, which are the most secure and what are the use cases. I go much deeper on XSS and CSRF in my FREE frontend security course, bu

[nguyen-oi]

localStorageとCookieの議論は一生やってるな。結局セッション管理をどうするかだし枯れた技術が一番安全というオチ

[mkusaka]

XSSでlocalStorageのJWTが盗まれる問題を解説し、HttpOnly cookieやBFF、refresh rotationで安全化する方法を提示