[frankpf]

Using a cookie is not a benefit, it's a downside. You have to deal with CSRFs, which aren't possible with localStorage.

[rdegges]

But then you open yourself up to XSS which is a lot harder to defend against.

[frankpf]

You don't open yourself up to XSS, see my comment above: https://news.ycombinator.com/item?id=20773188