Cookies, localStorage or sessionStorage?
Cookies, localStorage or sessionStorage — when do you use each?
Answer out loud in under a minute: a definition, one concrete example, and one pitfall or trade-off.
Hints
Hint 1
Compare size, lifetime and whether it's sent with requests — then give the security difference.
Solution
Show the approach
Answer
Cookies are sent automatically with every matching request, hold about 4 KB each, and can expire. localStorage holds about 5 MB per origin, is never sent, and is synchronous. sessionStorage has the same API, but belongs to one tab and is cleared when the tab closes. The security difference is the point: an HttpOnly cookie can't be read by script, so a session token in one survives XSS, and anything in localStorage does not.