Token Storage Scanner
Detects whether your JavaScript stores tokens in localStorage/sessionStorage, vulnerable to XSS theft.
What it checks
This scanner detects whether your JavaScript stores session or authentication tokens in the browser's localStorage or sessionStorage. It identifies when access credentials are kept in a place reachable from the page's own code.
Why it matters
Data stored in localStorage is readable by any JavaScript running on the page, so if there is an XSS flaw an attacker can steal the token and impersonate the user. It is a far less safe place for credentials than a properly protected cookie.
How to fix it
Whenever possible, store session tokens in cookies with the HttpOnly and Secure attributes, which JavaScript cannot read. If you must use tokens on the client, shorten their lifetime and pair this with solid protection against XSS.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free