Secure Local Storage Usage with AI Prompts

Audit my codebase for insecure localStorage/sessionStorage usage.

Search for:

• localStorage.setItem
• localStorage.getItem
• sessionStorage.setItem
• sessionStorage.getItem
• window.localStorage
• window.sessionStorage

For each usage, identify:

• What data is being stored
• Is it sensitive? (tokens, PII, secrets)
• Can it be accessed by XSS?
• Is there a safer alternative?

Flag as dangerous:

• Auth tokens (JWT, session IDs)
• API keys
• User PII (email, phone, address)
• Payment information
• Passwords or password hints

OK to store:

• UI preferences (theme, language)
• Non-sensitive cached data
• Draft content (with user consent)

Move auth tokens from localStorage to HttpOnly cookies.

Current (insecure): // Storing JWT in localStorage localStorage.setItem('token', jwt); // Sending in header fetch('/api', { headers: { Authorization: Bearer ${localStorage.getItem('token')} }});

New approach (secure): // Server sets HttpOnly cookie on login Set-Cookie: token=jwt; HttpOnly; Secure; SameSite=Lax; Path=/

// Client just makes requests, cookie auto-sent fetch('/api', { credentials: 'include' });

// Server reads from cookie instead of header const token = req.cookies.token;

Migration steps:

1. Update login endpoint to set HttpOnly cookie
2. Update API to read from cookie
3. Remove localStorage token code
4. Add CSRF protection (needed with cookies)
5. Update logout to clear cookie server-side

Implement a safe wrapper for localStorage.

Safe storage wrapper: const storage = { // Never store these types FORBIDDEN_KEYS: 'token', 'jwt', 'apiKey', 'password', 'secret',

set(key, value) { if (this.FORBIDDEN_KEYS.some(k => key.toLowerCase().includes(k))) { console.error(Security: Cannot store '${key}' in localStorage); return; }

try {
  localStorage.setItem(key, JSON.stringify(value));
} catch (e) {
  // Storage full or disabled
  console.warn('localStorage unavailable');
}

},

get(key) { try { const item = localStorage.getItem(key); return item ? JSON.parse(item) : null; } catch { return null; } },

remove(key) { localStorage.removeItem(key); } };

Use this wrapper instead of direct localStorage access.

Compare secure options for storing auth tokens.

Options ranked by security:

1. HttpOnly Cookie (Best)
   • Can't be accessed by JavaScript
   • Automatically sent with requests
   • Needs CSRF protection
   • Works well for SSR and traditional apps
2. Memory (Good for SPAs)
   • Store token in JavaScript variable/state
   • Lost on page refresh (may want this)
   • Pair with silent refresh for persistence
   • Immune to XSS persistence (token lost if page closes)
3. SessionStorage (Better than localStorage)
   • Cleared when tab closes
   • Still vulnerable to XSS
   • Better for short-lived tokens
4. localStorage (Avoid for tokens)
   • Persists forever
   • Fully exposed to XSS
   • Only use for non-sensitive data

Recommended pattern:

• HttpOnly cookie for refresh token
• Memory for access token
• Silent refresh to get new access token