Auth state is not stored in localStorage

localStorage is synchronously readable by every JavaScript file executing on your domain — your own code, third-party analytics, CDN-hosted widgets, and any XSS payload. Auth tokens stored there are exposed to the entire JavaScript surface area of your application. CWE-922 (Insecure Storage of Sensitive Information) and CWE-312 (Cleartext Storage of Sensitive Information) both apply. OWASP A02 lists insecure credential storage as a cryptographic failure. NIST 800-63B §7.1 requires that session secrets be protected from disclosure; localStorage provides no such protection.

Replace localStorage token storage with HttpOnly cookies set by the server. The browser sends HttpOnly cookies automatically with requests and JavaScript cannot read them at all:

// Remove this pattern entirely:
localStorage.setItem('token', jwtToken)

// Set the token server-side on the login response:
res.setHeader('Set-Cookie',
  `session=${token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=604800`
)

// For non-sensitive UI data, localStorage is still fine:
localStorage.setItem('displayName', user.name)

For React SPAs that need to make authenticated API calls, configure your HTTP client to include credentials (credentials: 'include' in fetch, withCredentials: true in Axios) so cookie-based auth works across your origin.