DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
API Development Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
API Development
A code review finds an SPA storing its access token in sessionStorage instead of relying on an HttpOnly cookie, with no other justification given. What should be flagged?
A
Nothing — this is always the correct default choice
B
This trades away HttpOnly's XSS protection for no clearly stated benefit — the choice should be deliberate given the real XSS-exposure tradeoff, not a default made purely for convenience
C
sessionStorage is identical in security properties to HttpOnly cookies
D
This is only a concern if the app has no XSS vulnerabilities at all, which is always guaranteed
Check Answer