Access token in localStorage
Scan rule · RSC-SEC-020
- Security
- Severity: Medium
- CWE-922
Observes at runtime whether a JWT-like value ends up in web storage — readable via XSS.
Scan tier
- Browser runtime
How to fix it
Keep tokens in `HttpOnly` cookies instead of localStorage.