Where to keep a login token

A token in localStorage is convenient: easy to read, easy to attach to requests, survives a refresh. It is also readable by any JavaScript running on the page, which means a single injection anywhere — your code, a dependency, a chat widget — hands it over.

An HttpOnly cookie is not readable by JavaScript at all. The browser attaches it automatically, so your code never touches it, and an injected script cannot exfiltrate it.

A stolen token works from anywhere until it expires. You cannot invalidate it from the browser. With server-side sessions you can delete the row and the session ends immediately, which is what makes "sign out everywhere" possible.

Check your auth provider first — Supabase Auth, Clerk, and Auth.js all support cookie-based sessions, and switching is usually a configuration change rather than a rewrite.

Then have the server set the cookie with httpOnly, secure, and sameSite: "lax", change the frontend to send credentials with requests instead of an Authorization header, and remove every localStorage call for auth values.