(anyone can downvote my post but downvote and not sharing any good opinion is like a shiiter) I'm building a web app using Spring Boot (backend) and React (frontend). My authentication is based on JWT, with both access token and refresh token.

• The refresh token is stored in an HTTP-only cookie.
• The access token has a short lifetime (15 minutes).

I'm unsure where the access token should be stored on the frontend:

1. localStorage - easy to use but potentially vulnerable to XSS attacks.
2. In-memory (e.g. React state or a context) - safer, but the token is lost when the user refreshes the page.

In this setup, what is the recommended place to store the access token, and why? Should I keep it in localStorage for persistence, or only in memory for security?

I'm building a web app using Spring Boot (backend) and React (frontend). My authentication is based on JWT, with both access token and refresh token.

• The refresh token is stored in an HTTP-only cookie.
• The access token has a short lifetime (15 minutes).

I'm unsure where the access token should be stored on the frontend:

1. localStorage - easy to use but potentially vulnerable to XSS attacks.
2. In-memory (e.g. React state or a context) - safer, but the token is lost when the user refreshes the page.

In this setup, what is the recommended place to store the access token, and why? Should I keep it in localStorage for persistence, or only in memory for security?

I'm building a web app using Spring Boot (backend) and React (frontend). My authentication is based on JWT, with both access token and refresh token.

• The refresh token is stored in an HTTP-only cookie.
• The access token has a short lifetime (15 minutes).

I'm unsure where the access token should be stored on the frontend:

1. localStorage - easy to use but potentially vulnerable to XSS attacks.
2. In-memory (e.g. React state or a context) - safer, but the token is lost when the user refreshes the page.

In this setup, what is the recommended place to store the access token, and why? Should I keep it in localStorage for persistence, or only in memory for security?

(anyone can downvote my post but downvote and not sharing any good opinion is like a shiiter) I'm building a web app using Spring Boot (backend) and React (frontend). My authentication is based on JWT, with both access token and refresh token.

• The refresh token is stored in an HTTP-only cookie.
• The access token has a short lifetime (15 minutes).

I'm unsure where the access token should be stored on the frontend:

1. localStorage - easy to use but potentially vulnerable to XSS attacks.
2. In-memory (e.g. React state or a context) - safer, but the token is lost when the user refreshes the page.

In this setup, what is the recommended place to store the access token, and why? Should I keep it in localStorage for persistence, or only in memory for security?