Replay · Code · sample case

Is localStorage OK for our login token?

7 min from acceptance to signature · $11.2 paid · A senior engineer (sample) · L2 · illustrative numbers

Customer

Is it safe to store the JWT in localStorage for our production React app?

Answer A · judged blind

No. Any script on the page can read localStorage. Keep the token in an httpOnly cookie instead.

Expert enters

Senior engineer

The AI is right. One thing it did not say: once the token lives in a cookie, the browser sends it automatically — so you now need CSRF protection on every state-changing request.

✓ AI confirmed — one addition

Scores — revealed after signing

answer	core	facts	missing question	risk
A · Claude	5	5	3	4

1–5 each. Model names stay hidden until the letter is signed, so the judge cannot favour a brand.

Signed letter sample

What I checked

Token storage for a browser app: localStorage vs httpOnly cookie.

What I could not check from here

Your actual backend, whether you use SameSite cookies already.

The question you must answer before deciding

Do your state-changing endpoints verify a CSRF token or SameSite=Strict?

My verdict

Confirmed: move the token to an httpOnly, Secure, SameSite cookie — and add CSRF protection the same day.

Ask the same way · my own question Experts: plug in your card

Nothing here is advice for you — your numbers differ. A case lands on the Floor only with two consents, and either side can take it down in one tap.