CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
What is the key difference between using sessionStorage and localStorage for storing tokens in a web application?
- A.localStorage is scoped to the tab; sessionStorage persists across all tabs; the session ID must be mirrored into localStorage as well, letting the server detect divergence and kill hijacked sessions
- B.sessionStorage is not accessible to JavaScript; localStorage is
- C.sessionStorage is encrypted; localStorage is not
- D.sessionStorage is cleared when the browser tab is closed; localStorage persists until explicitly cleared. Both are equally accessible to JavaScript, so both are equally vulnerable to XSS
Why D is correct
The persistence difference: sessionStorage data lives only for the browser tab session and is cleared on close; localStorage persists across sessions. However, from an XSS attack perspective, both are equally readable by JavaScript running on the same origin. Neither provides the protection of HttpOnly cookies against XSS-based token theft.
Know someone studying for Web App Fundamentals? Send them this one.