Security difference between using localStorage and sessionStorage?

[turbolego]

I know that there's a difference between localStorage and sessionStorage when it comes to persistence, but is there a security difference between localStorage and sessionStorage if the tokens have the same expiration-time?

I was able to switch from sessionStorage to localStorage by just flipping every instance of "sessionStorage" to "localStorage" and set this is in auth-service file: "userStore: new Oidc.WebStorageStateStore({store: localStorage})".

But is there any difference in terms of security?

Thanks! 😄

[jeroenheijmans]

Your token "expires" effectively when either it expires based on expiration-time, or when the storage mechanism purges it.

Since sessionStorage is typically shorter-lived (doesn't survive a browser restart, normally) and less broad available (scoped to your browser tab, whereas localStorage is available to your app in all tabs), there will be less attack vectors.

[turbolego]

Your token "expires" effectively when either it expires based on expiration-time, or when the storage mechanism purges it.

Since sessionStorage is typically shorter-lived (doesn't survive a browser restart, normally) and less broad available (scoped to your browser tab, whereas localStorage is available to your app in all tabs), there will be less attack vectors.

Thank you @jeroenheijmans ! 😄 So tokens stored in either sessionStorage or localStorage can be attacked using the same methods? Is there attack-methods that only work for localStorage that won't work for sessionStorage?