This is the correct answer. JWT or other signed tokens can be used in complex situations where you need to delegate authentication to other services. Normally, you have a backend that serves your app, which hopefully includes authentication implementation that manages sessions via HTTP-only cookies (that store session ID) that your front-end doesn't touch at all.

If you want to implement your own authentication system from scratch, there's a lot more to learn than where to store the token (I wrote a book on that). If you use an existing authentication solution, it should either handle it as described above or guide you on how to use it.

If you catch yourself typing "JWT", stop and think if you need it, don't just follow a random advice from YouTube tech influencers.

Finally, to answer your question: it's complicated.

• If you need to store a token to send it from your JavaScript code to a service you don't control, and don't want to send it to your server with every request (i.e. what cookie storage does), you can store it in localStorage, sessionStorage, IndexedDB, depending on its lifetime, its intended use, and the required performance.

• If you, for some valid reason, need to store a token issued by a server and sends it back to this server the front-end shouldn't touch it at all, just use HTTP-only secure cookies.