256
web storage
also localStorage, sessionStorage, IndexedDB
localStorage is a synchronous string bucket. It is not a session and not a database.
What is web storage?
localStorage is synchronous, shared by every tab of the origin, string-only, and it survives restarts. sessionStorage is per tab. IndexedDB is asynchronous and holds structured data. None of them are private from scripts on the origin. Credentials belong in an httpOnly cookie, not in localStorage.
Why does web storage matter when vibe coding?
The draft stores the access token in localStorage because the example did. Any XSS reads it. A second tab writes a stale copy over the fresh one. A 5MB quota then throws in the middle of a click.
How do you do web storage?
Put tokens in an httpOnly cookie. Use localStorage for non-secret preferences. Use IndexedDB for documents the app must query. Handle the quota error.
How do you ask a model for web storage?
Store (data) in (localStorage or IndexedDB). Do not store access tokens or refresh tokens in web storage. Keep those in an httpOnly cookie. Handle quota errors.
What goes wrong with web storage?
JSON.parse on every read of a large localStorage key during render. It blocks the main thread.