Browser Storage
| Feature | localStorage | sessionStorage | cookies |
|---|---|---|---|
| Storage Capacity | ~5–10 MB | ~5 MB | ~4 KB |
| Expires | Never (until cleared) | On tab close | Optional (set by expires) |
| Accessible by | Browser (client only) | Browser (client only) | Browser + Server |
| Data Type | String | String | String |
| Scope | All tabs (same origin) | Single tab/window | Domain/path-based |
| Auto-sent to server? | No | No | Yes |
| Best for | Long-term preferences | Temporary session data | Authentication / Tracking |
Security Notes
| Concern | Explanation |
|---|---|
| XSS (Cross-Site Scripting) | If attacker injects JS, they can read your local/session storage. Always sanitize inputs. |
| Cookies | Should use HttpOnly and Secure flags to prevent JavaScript access and ensure HTTPS-only transmission. |
| Sensitive Data | Never store passwords or tokens in plain text in localStorage or cookies. |