---
id: 5540
title: "Web Storage: the lesser evil for session tokens"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/web-storage-the-lesser-evil-for-session-tokens"
published_at: "2021-02-01T11:33:00Z"
tags: ["web-security", "cookies", "session-tokens", "localstorage", "web-storage"]
phying_url: "https://phying.com/item/5540"
lang: en
---

# Web Storage: the lesser evil for session tokens

## Summary

James Kettle argues Web Storage (sessionStorage/localStorage) is often a safer home for session tokens than cookies, examining the Secure flag, HttpOnly and the path attribute.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2021-02-01T11:33:00Z
- **Original:** https://portswigger.net/research/web-storage-the-lesser-evil-for-session-tokens
- **Phying News:** https://phying.com/item/5540