Is web storage preferable over cookies for storing sessionId? [duplicate]

Question

This question already has answers here:

Is it okay to store session id in localStorage? (2 answers)

Closed 5 years ago.

Is it more secure to hold the sessionId at client side (to avoid logging in each time) using local storage or session storage rather than using cookies?

Answer 1

No! Keep the sessionid at client-side is a bad idea, because it can be easily captured by an attacker (by XSS, for example). Any information hold in web storage is unprotected.

Hold your sessionid in a cookie and don't forget to mark HttpOnly and secure flags.