A JWT needs to be stored in a safe place inside the user’s browser . If you store it inside localStorage, it’s accessible by any script inside your page. This is as bad as it sounds; an XSS attack could give an external attacker access to the token.
Read more