title: Where is safest to store Json Web Tokens JWTs in client side?
body: <p>Hello stackoverflow community!</p>
  
  <p>We build an SPA app with nuxts.js framework and we arrived to the point which is the safest way to store a JWT token from our backend API service. </p>
  
  <p>We have two options cookies with httpOnly flag versus localStorage. I read a ton of articles about the comparison of this two options, althought half of developers support cookies and half of developers support localstorage.</p>
  
  <p>For my point of view cookies seems safer way than localStorage to store a JWT in client side but i wonder if there is even a safer way than the above options.</p>
  
  <p>So i thought about something. Nuxt.js framework offer us the opportunity to store   environmental variables. Is it safer to store a JWT token as an environmental variable or is exact the same like the above options or is even worst.</p>
  
  <p>Thank you in advance!</p>