LocalStorage was a mistake...

Keeping any sensitive information in LocalStorage is a pretty bad idea. It's great for things like user preferences, language settings, light/dark mode and other stuff your users are allowed to change. But for payment info or session ids, that's a NO from me dawg

-- my links

[jaspreetmaan]

if someone can find a way to execute javascript on your app, then you are already screwed, doesn't matter if you token is in cookies or local storage

[muratcemyalin]

josh you are making great videos but sometimes you are making videos with half baked knowledge which leads people wrong direction. Local storage data is only accessible within the same domain and protocol that created it, restricting its cross-domain usage. if your website is vulnarable to xss localstorage or cookie doesnt do much. Next time please search more about a topic before making video.

[QwDragon]

Your advice is like: Don't store your everyday jewelry in your house as if somebody finds as key under backdoors carpet he can steal them. Instead lock them in a bank cell and never take out of there.

LS and cookies are absolutely different things for different perposes. It's not a problem of LS that it can be accessed. If you need this data in the script you need to get it from somewhere and http-only cookies aren't for that.

[theramenboy]

I can understand the "not put sensible informations" in the LocalStorage, it apply to multiple scenario not only this one. Other than that the "LocalStorage was a mistake..." it's only a clickbait title.

[CookerSingh]

Now he banned local storage. The channel should be renamed as "Josh is still figuring out Coding"

[kapobajza]

I think your points are not really valid for calling out localStorage to be a mistake. It has flaws, but cookies also have flaws. In fact everything has flaws, because it's man-made.
If you're afraid that your app might be vulnerable to XSS attacks, then make your app more XSS proof rather than stop using localStorage. I mean XSS attacks can target a whole lot of different areas than just localStorage. The attacker has control over the whole JS part of the victim. They can do whatever JS is capable of doing, not just accessing localStorage or cookies.
In addition to making your app more XSS proof, you can also make your localStorage more secure by encrypting its data. In my opinion that might be overkill but if you're paranoid, sure, go ahead.

[parlor]

Sure, cookies are not vunerable to XSS, but they're vunerable to CSRF. And just like how CSRF can be circumvented using CSRF tokens, XSS can also be circumvented by using two tokens, one stored in local storage and one stored in a secure cookie (usually called access and refresh tokens though those specific names entail additional functionalities).

Also to clarify, document.cookie is a string that's the concatination of all the cookies stored. It's undefined in this example, but if you have multiple cookies, among which a few are secure (http only), document.cookie would be defined and will contain all the non-secure cookies.

[hebid]

xss attack doesn't need to steal your cookie, it can just steal your bank money by making requests using the cookie

[krome]

for viewers: it's ok to use LS :)

[bgdnsr]

my god dude, learn how the web works. cookies do nothing for you if an attacker is in, he can make requests that pass along the cookie

[David-gjdc]

The solution to XSS is to sanitize your inputs and outputs, not to never use localStorage. If you're using a popular framework it's probably already sanitizing your outputs for you even. I feel like this video is mixing up a bunch of topics that don't necessarily need to be.. it comes across as a bit unfocused to me

[NuncNuncNuncNunc]

I hung my front door key from teh screen door, now someone has taken all my stuff. Don't use doors.

[boi-kheko]

Summary "USE COOKES" for private things

[NateTron]

josh u got me back into coding i use ur stuff day to day and i love how you structure your projects! thank you for all that you do

[marcusg]

This guy just thought he outsmarted W3C without even reading the specs first lol. Worst things script kiddies like this and that Theo guy are consumed by juniors who actually buy into it all, which is sad for the software industry.

[kekw]

Who the fuck would ever save sensitive things in localstorage?

[baetraki]

I just don't agree with this vdeo, and the topic just not for this channel, 99% of people watching ur content know what u talked about in this video

[Hobbitstomper]

Damn it. I wrote this massive comment that took 10min to write, on how ProtonMail uses encrypted local storage to make their email content searchable, only for YouTube to auto delete my comment. FKN hell.

[bbfrancis]

You are using localstorage in the wrong way. Save theme data there, what page the user is on, on a table. Localstorage was not a mistake what makes you think you are smarter than a whole corporation. They thought about long and hard.

[BlurryBit]

Local storage was not a mistake. It has its uses. Even cookies are not secure if you don't have the correct configuration. People should stop using local storage for what it is not meant for lol.