A fintech app stores a user's JWT in localStorage. A security audit flags this. What is the recommended alternative and why?
-
A
Store the JWT in sessionStorage for automatic expiry
-
B
Store the JWT in an HttpOnly, Secure, SameSite=Strict cookie to prevent JavaScript access
-
C
Base64-encode the JWT before storing in localStorage
-
D
Store the JWT in a Redux store