Authentication tokens stored securely, not exposed in localStorage

OAuth tokens and session tokens stored in localStorage are readable by any JavaScript running on the page — including third-party scripts, ad networks, and XSS payloads. Because extensions share the DOM with page scripts when using content scripts, a single XSS vulnerability on any site the user visits can silently extract a token and enable full account takeover. OWASP 2021 A02 and CWE-312 both call this out: storing sensitive credentials without isolation is a broken authentication failure. GDPR Art. 32 requires appropriate technical measures to protect personal data — storing auth tokens in localStorage fails that standard.

Move all user authentication tokens from localStorage or sessionStorage into chrome.storage.local, which is sandboxed from page scripts:

// BAD — accessible to any page script
localStorage.setItem('token', response.access_token);

// GOOD — isolated to extension context
chrome.storage.local.set({ authToken: response.access_token });

// BEST — memory only (token lost on extension unload, no persistent attack surface)
let authToken = null;
authToken = response.access_token;

For tokens that must persist across sessions, use chrome.storage.local with encryption via a library like TweetNaCl.js rather than storing plaintext.