title: Should JWT be stored in localStorage or cookie?
body: <p>For the purpose of securing REST API using JWT, according to some materials (like this <a href="https://auth0.com/blog/2016/01/04/secure-your-react-and-redux-app-with-jwt-authentication/" rel="noreferrer">guide</a> and this <a href="https://stackoverflow.com/questions/27067251/where-to-store-jwt-in-browser-how-to-protect-against-csrf">question</a>), the JWT can be stored in either <strong>localStorage</strong> or <strong>Cookies</strong>. Based on my understanding:</p>
  
  <ul>
  <li><strong>localStorage</strong> is subjected to XSS and generally it's not recommended to store any sensitive information in it.</li>
  <li>With <strong>Cookies</strong> we can apply the flag "httpOnly" which mitigates the risk of XSS. However if we are to read the JWT from Cookies on backend, we then are subjected to CSRF.</li>
  </ul>
  
  <p>So based on the above premise - it will be best if we store JWT in Cookies. On every request to server, the JWT will be read from Cookies and added in the Authorization header using Bearer scheme. The server can then verify the JWT in the request header (as opposed to reading it from the cookies).</p>
  
  <p>Is my understanding correct? If so, does the above approach have any security concern? Or actually we can just get away with using localStorage in the first place?</p>