Hacker News new | ask | show | jobs
by croola 932 days ago
look at any web client based authentication system like firebase or amazon cognito from FAANG companies. Cognito by default stores it in local storage, and firebase stores in index db and local storage. You can switch to cookies, but it is not possible to set httponly flag because they are client based (js based). And that's the tip of the iceberg.