[porridgeraisin]

Just store it in localStorage...

It is just fine.

If anyone is allowed to inject javascript in your site, samesite=lax httponly cookies aren't gonna help much either.. the attacker can fetch /api/me/delete with credentials: include (just like you would have to do in your js code) and it's game over.

And extensions can access httpOnly cookies as well. Not to mention other applications can simply access the plain sqlite db.

So really, just use local storage for tokens.

This way, if you want to expire sessions via refresh tokens, you can simply layer it on top of this, by setting a refresh token in a cookie and adding some extra logic to the api calls.