← BlogLovable3 min readUpdated 2026-08-03

Lovable: can a script steal your users' logins?

A session token in localStorage is readable by any script on the page. Here is how to check where yours lives.

When someone logs into your app they get a token. Everything after that — every request that proves who they are — depends on that token staying out of other people's hands. Where you keep it decides how hard that is.

The localStorage problem

Supabase's JavaScript client stores the session in localStorage by default, and Lovable does not change that. localStorage is readable by any JavaScript running on the page — including a script injected through a bug, and including code from any third-party library you added.

A cookie marked HttpOnly is different: the browser sends it with requests but refuses to let JavaScript read it. That single flag is the difference between a text-injection bug being cosmetic and it being account takeover.

Check it yourself, two minutes

Find out where your session lives

  1. 1Log into your app, press F12, open Application (Chrome) or Storage (Firefox).
  2. 2Click Local Storage → your domain. Look for a key like sb-<project>-auth-token.
  3. 3If you see a long token there, any script on your page can read it.
  4. 4Now open Cookies for your domain. For each cookie holding a session, check the HttpOnly, Secure and SameSite columns.
  5. 5In the Console, type: document.cookie — anything printed is readable by scripts. Your session token should not appear.
Paste this into Lovable
Review how my app stores sessions and harden it.

1. Tell me where the auth session is currently stored (localStorage,
   sessionStorage, or cookies) and which scripts on the page can read it.
2. Move the session to cookies set with HttpOnly, Secure and SameSite=Lax,
   using the Supabase server-side auth helpers rather than the default
   browser storage.
3. Set a sensible session lifetime and make sure refresh tokens rotate.
4. Add a Content-Security-Policy header restricting script-src to my own
   domain, so an injected script cannot run in the first place.

If moving off localStorage would break something in my current setup, say
so explicitly and tell me what the alternative protection is instead of
doing it silently.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free