🩴🩴 it’s exposing it to JavaScript. 1️⃣ LocalStorage can be accessed by any JavaScript running on the page. 2️⃣ If an attacker injects malicious script (XSS), the JWT can be stolen. 3️⃣ Once stolen, the attacker can impersonate the user. 4️⃣ LocalStorage has no built-in protection like HttpOnly. 5️⃣ Tokens can be reused until they expire. 6️⃣ HttpOnly cookies prevent JavaScript from reading the token. 7️⃣ That significantly reduces token theft via XSS. #interview #dotnet #systemdesign #backend