CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What is the key difference between using sessionStorage and localStorage for storing tokens in a web application?
- A.sessionStorage is encrypted; localStorage is not
- B.sessionStorage is not accessible to JavaScript; localStorage is
- C.sessionStorage is cleared when the browser tab is closed; localStorage persists until explicitly cleared. Both are equally accessible to JavaScript, so both are equally vulnerable to XSS
- D.localStorage is scoped to the tab; sessionStorage persists across all tabs
Why C is correct
The persistence difference: sessionStorage data lives only for the browser tab session and is cleared on close; localStorage persists across sessions. However, from an XSS attack perspective, both are equally readable by JavaScript running on the same origin. Neither provides the protection of HttpOnly cookies against XSS-based token theft.
Know someone studying for Web App Fundamentals? Send them this one.