How to securely store JWT in browser?

Question

I'm using Angular 10 for front-end. I'm getting JWT from Back end services. I need to store my Okta JWT securely in browser. I studied about storing token in window.sessionStorage or window.localStorage or HTTP only secure cookie. But, I'm not sure how to avoid XSS and XSRF attacks.

What is the best approach to store JWT securely and traverse adhering to XSS and XSRF prevention?

Thanks in advance

Answer 1

It is not possible for the data held on the client side to be "secure". There is nothing more than a JsonWebToken implementation with a short expiration time. By keeping them in local storage, you can additionally encrypt them and decrypt them in the case of the need to use the token to communicate with the server.

I recommend reading this article by George Koniaris.