html - Is it okay to store session id in localStorage?

Question

Is it secure to store user's session id in localStorage? On w3.org site, they say

User agents must raise a SECURITY_ERR exception whenever any of the members of a Storage object originally returned by the localStorage attribute are accessed by scripts whose effective script origin is not the same as the origin of the Document of the Window object on which the localStorage attribute was accessed.

So does this mean localStorage could be used for sensitive data?

Answer 1

httpOnly cookies provide a layer of XSS defence that localStorage does not provide:

• httpOnly cookies are not accessible from [potentially malicious] JS.
• localStorage is accessible from JS.

Session IDs should be stored in httpOnly secure cookies.