TS · security

←Previous Next→

no-credential-in-browser-storage

Do not write credential-named values to browser storage or script-readable cookies.

noCredentialInBrowserStorage Rule source Tests Catalog JSON

Why

localStorage, sessionStorage and cookies written through document.cookie are readable by any script on the origin, so one injected script can copy the credential and replay it elsewhere.

Fix

Keep the credential on the server and send it as an httpOnly, Secure, SameSite cookie set by a server response, or hold a short-lived token in memory only.

Examples

Before — flagged Do not store an access token in localStorage

src/session.ts

export function remember(token: string): void {
  localStorage.setItem("accessToken", token);
}

After — preferred Store a non-credential preference in localStorage

src/theme.ts

localStorage.setItem("sidebar-collapsed", "true");