Insecure token storage in client applications

8/10 High

Applications store OAuth tokens in `localStorage`, `sessionStorage`, or insecure cookies, exposing them to XSS attacks and other client-side script injection threats.

OAuth 2.0

Sources

https://treblle.com/blog/oauth-2.0-for-apis
https://howik.com/oauth-2-0-common-issues
https://duendesoftware.com/learn/7-common-security-pitfalls-oauth-2-0-implementations

Collection History

Query: “What are the most common pain points with OAuth 2.0 for developers in 2025?”3/31/2026

In browser-based applications, placing tokens in `localStorage` or `sessionStorage` exposes them to any script running on the page, including malicious scripts injected through Cross-Site Scripting (XSS) attacks.

Created: 3/31/2026Updated: 3/31/2026