From Dev.to
Browser Secrets That Leak: Token Storage, Quotas & Outbound Controls
During an authorised security review for a client last year I opened DevTools on their admin dashboard, went to Application, then Local Storage, and found a JWT with a 30-day expiry, an admin: true cl...