Where does the session actually live?

quiz
hard
server
12 min
server-session
mark done

Session handling is where frontend architecture meets security, and where the convenient choice and the correct one usually disagree.

Your SPA stores its access token in localStorage so the app can read it after a reload. What is the concrete risk?

A localStorage is slow
B Any script that runs on your origin can read it — one compromised dependency or one XSS and the token leaves with the attacker
C The token expires sooner
D It breaks on Safari

You move to an httpOnly cookie. What does that NOT solve?

A Token theft via XSS
B Cross-site request forgery — the browser now attaches the cookie automatically, including on requests a third-party site triggers
C Session expiry
D Nothing, cookies solve everything

A server-rendered page needs the user's name on first paint. Where does the session check belong?

A In a useEffect after hydration
B On the server, before the HTML is produced, with the result embedded in the response
C In a client-side route guard
D In localStorage

Your access token lives 15 minutes and a refresh token renews it. Two tabs hit expiry at the same moment. What goes wrong, and what fixes it?

A Nothing, refresh is idempotent
B Both tabs refresh; with refresh-token rotation the second presents a token the server has already retired, and the user is logged out. Serialise refresh across tabs
C The tokens merge
D The second tab waits automatically

Reading: Session · Authentication · SSR
Playbook: Frontend system design
Agent Skill: server-session