What is 'web storage (localStorage/sessionStorage) security' and what data should NOT be stored there?

• A.Web storage is encrypted by the browser at rest - including localStorage keys; localStorage.getItem('token') is hard to read without the profile password. Session tokens, JWTs, and access tokens belong in localStorage for all single-page apps; tokens in HttpOnly cookies are visible to JavaScript. localStorage is appropriate for: tokens, private keys, preferences
• B.Web storage is accessible to all JavaScript on the page - including XSS payloads. localStorage.getItem('token') is trivial to read in a single line. Session tokens, JWTs, access tokens, private keys, PII, and passwords should NOT be in localStorage. Tokens should be in HttpOnly cookies (invisible to JavaScript). localStorage is appropriate for: UI preferences, non-sensitive cache, feature flags
• C.Web storage is shared with every origin on the same eTLD+1 - including cookies; localStorage.getItem('token') is scoped to the tab and expires at close. Session tokens, JWTs, and passwords should NOT be in sessionStorage; tokens should be in localStorage (partitioned per site). localStorage is appropriate for: session state, credentials, feature flags