Protecting access token from XSS attack

Question

I've been doing some research on where to store access token after login. People say local storage is not secure since it can be read using javascript (vulnerable to XSS) and recommend http-only cookies instead.

But let's say my website is vulnerable to XSS and some malicious code gets run to fetch data from my API. It should still work since the cookie just gets automatically added to the request right? They don't know what the cookie is but the request still works in the end. With XSS the malicious code would be running as if it is from my site.

Am I correct in this?

Answer 1

You are correct, the attacker will able to make what ever your api allows.

The Idea behind "saving the token in an HTTP only cookie" is to prevent from client side to access the token in order to steal it.