Alternatives to LocalStorage for Storing Authentication Data

[ahmadmujeeb33]

Core Library

MSAL.js (@azure/msal-browser)

Wrapper Library

MSAL Angular (@azure/msal-angular)

Public or Confidential Client?

Public

Description

If I want to enable SSO across browser tabs, is there an alternative to using localStorage? I’ve read that storing sensitive information like access tokens or ID tokens in localStorage can pose security risks, even though MSAL allows it.

My goal is for a user to log in once and remain authenticated when they open a new tab, but without relying on localStorage. Are there more secure approaches to achieve this?

[konstantin-msft]

Hi @ahmadmujeeb33.

If an attacker has JavaScript execution access in the context of your origin, they can already intercept tokens from network responses, fetch/XMLHttpRequest overrides, or sessionStorage — regardless of where tokens are stored on the client. Moving tokens out of localStorage doesn't meaningfully raise the bar in the threat model.

LocalStorage is the recommended approach when cross-tab SSO is required. It's partitioned by domain and sub-domain.