is storing JWT token in local storage safe?

Question

I m creating a web app, basically an Admin control panel, using Angular and Laravel and used JWT to secure my apis. My question is - if jwt token stores in local storage which is being used to authenticate all my api request, what if someone copy jwt token from local storage, and use it for api requests separately from the app? Then how is it secure? and what is the way secure it?

Answer 1

It is not safe to save tokens in local or session storage. Those storages are vulnerable on XSS attacks. A good practise is to keep them in memory (as a variable) or as a http only cookie..