Stop storing JWT in LocalStorage! And stop using JWT.
I’ve been developing single-page web-apps for a while now, and it’s gotten into my habit to use LocalStorage to store JWTs. The reason I used JWT was to embed data about the user, and keep it on the client-side, to authenticate (identify) requests/users. Figured out a while ago that it was wrong. On many levels! TL;DR — don’t use JWT and don’t store sensitive data in LocalStorage For starters, it’s not okay to store auth data in LocalStorage.
Read more →