Blog

Where Should Tokens Live? The Threat Model of localStorage, Memory, Cookies, Service Workers and the BFF

No browser storage location can stop XSS from sending requests as the user; the difference is whether the token can be read and carried away, which is why RFC 10017 recommends a BFF that never hands tokens to the browser. In this post we test localStorage, memory and HttpOnly cookie models with simulated XSS in an Angular 22 and ASP.NET Core 10 lab, weigh Web/Service Worker and refresh token risks, and pin down Bookstore's BFF decision with tests.