Security Pitfalls in React Apps I Learned the Hard Way (opens in new tab)

A few months back I was doing a code review for a friend's project and noticed they were storing JWTs in localStorage. I almost said nothing because honestly, I had done the same thing in like three projects before someone pointed it out to me. That's kind of the problem with frontend security. Nobody really teaches it properly, so we all just copy patterns from tutorials that were written to be quick, not safe. So here's what I've picked up, mostly from messing things up myself or catching b...