Prompt: move sessions out of localStorage
A token in localStorage is readable by every script on the page, including one that got there by accident.
Where you keep the session decides how bad a script-injection bug is. In localStorage, any JavaScript on the page can read it and impersonate the user. In an HttpOnly cookie, the browser refuses to hand it to JavaScript at all.
Copy this into Cursor, Claude Code, Lovable or your builder
Move my authentication session from browser storage into HttpOnly cookies. 1. Tell me where the session is stored today and which code can read it. 2. Move it to cookies set with: HttpOnly, Secure, SameSite=Lax, Path=/, and an explicit expiry. 3. Use the framework's server-side auth helpers so the session is read on the server, rather than hydrating it from client storage. 4. Remove every place the raw token is written to localStorage or sessionStorage. 5. Add CSRF protection — cookies are sent automatically, which is exactly what makes cross-site request forgery possible. SameSite=Lax covers most of it; add a token for state-changing POST routes. If this cannot be done without breaking something in my current setup, say so explicitly and describe what protection to use instead, rather than half-migrating.
What your AI should do with it
- All four cookie attributes set, not just HttpOnly.
- CSRF protection added at the same time — the two changes belong together.
- An honest answer if the migration does not fit your stack.
How to check it worked
Ask the browser directly
- 1Log into your app and open the Console.
- 2Type: document.cookie
- 3Your session token must not appear in the output.
- 4In Application → Cookies, confirm HttpOnly, Secure and SameSite are all set on the session cookie.
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free