Ctrl K
Sign inStart free
Frontend · Mid-level · Theory

Where would you store the auth token in an SPA, in localStorage or in a cookie, and which attacks does that protect against and which doesn't it?

~4 min by voice

How to approach it

The interviewer checks whether the candidate understands the threat model rather than just "where it's customary to store it": localStorage is exposed to XSS, a cookie opens up CSRF, and neither option replaces protection against XSS itself.

Have you seen this question in a real interview?
Answers0
Avg. score—
Strong—
Practiced0
Topics
xsscsrf
Similar questionsWhat is an XSS attack, and how does the frontend protect against it? JuniorWhere do you store auth tokens in the browser, and why? How are CSRF and CORS related to that choice? SeniorHow do you protect a frontend against XSS, and how would you roll out a Content Security Policy in a large application that's already in production? Senior

Answer by voice

The interviewer will ask this question and listen. Think out loud and ask for a hint if you need one. When you're done, pause or tap “That's my answer”. In about a minute, your score and the points you covered show up here.

Sign in to answer

Best with headphones · ~4 min