Ctrl K
Sign inStart free
Frontend · Senior · Theory

Where do you store auth tokens in the browser, and why? How are CSRF and CORS related to that choice?

~4 min by voice

How to approach it

This checks whether you understand the trade-off between XSS and CSRF when choosing where to store a token. It also matters whether you can tell CSRF and CORS apart: many people confuse the two mechanisms and think CORS is a defense.

Have you seen this question in a real interview?
Answers0
Avg. score—
Strong—
Practiced0
Topics
csrfcors
Similar questionsWhat is CORS, and why does the browser block a request to an API on a different domain? JuniorA request from the frontend fails with a CORS error, but the same request works from Postman. Explain what's going on and how to fix it. Mid-levelWhere would you store the auth token in an SPA, in localStorage or in a cookie, and which attacks does that protect against and which doesn't it? Mid-level

Answer by voice

The interviewer will ask this question and listen. Think out loud and ask for a hint if you need one. When you're done, pause or tap “That's my answer”. In about a minute, your score and the points you covered show up here.

Sign in to answer

Best with headphones · ~4 min