As a general rule, the token should not be stored on the localStorage
neither the sessionStorage
. Both places are accessible from JS and the JS should not care about the authentication token.
IMHO The token should be stored on a cookie with the HttpOnly
and Secure
flag as suggested here: https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage