---
title: "Keep tokens and sensitive data out of · Agent Wranglers"
url: https://agentwranglers.se/playbook/app-ui/client-and-server-state/sensitive-data-out-of-browser-storage
id: APP-76
level: Required
applies: accounts
risk: takeover
updated: 2026-10-22
build: a2a6bdfed830
tokens: 1229
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep tokens and sensitive data out of browser storage

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Client and server state](https://agentwranglers.se/playbook/app-ui/client-and-server-state.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: APP-76
- Level: Required
- Chapter: [Client and server state](https://agentwranglers.se/playbook/app-ui/client-and-server-state.md)
- Rule: Keep access tokens, passwords, card data, government ID numbers and health data out of `localStorage`, `sessionStorage` and IndexedDB. Delete every draft and offline copy an account stored when it signs out.
- Check: A browser test signs in, opens every screen with a draft or offline feature and dumps `localStorage`, `sessionStorage` and every IndexedDB store. The dump holds 0 tokens, JWTs, card numbers or test ID numbers. After sign-out, it holds 0 keys for that user.
- Risk: An account or system taken over
- Applies when: The project has user accounts.
- How: Any script on the page can read browser storage, so one cross-site scripting hole hands all of it to an attacker. Anyone who uses the same device can read it too. Keep the session in an `HttpOnly` cookie, as [session cookies](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/session-cookies.md) says. Store drafts and offline queues under keys that start with the user's ID, and keep only the fields the screen needs. Prefer `sessionStorage` when the data need not outlive the tab. On sign-out, delete those keys and IndexedDB stores, then send the header from [wipe browser data on sign-out](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/clear-site-data-on-sign-out.md). Validate what you read back like any other input. Native apps keep tokens in the system store instead, as [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### TypeScript example

```ts
export async function forgetUserOnThisDevice(userId: string) {
  for (const storage of [localStorage, sessionStorage]) {
    for (const key of Object.keys(storage)) if (key.startsWith(`${userId}:`)) storage.removeItem(key);
  }
  for (const { name } of await indexedDB.databases()) {
    if (name?.startsWith(`${userId}:`)) indexedDB.deleteDatabase(name);
  }
}
```

### Python example

```python
TOKEN_PATTERN = re.compile(r"eyJ[\w-]+\.[\w-]+\.|Bearer |\b\d{13,19}\b")

def test_browser_storage_holds_no_secrets(signed_in_page):
    signed_in_page.goto("https://app.example.com/invoices/new")
    signed_in_page.get_by_label("Customer").fill("Northwind Traders")
    dump = signed_in_page.evaluate("JSON.stringify([{...localStorage}, {...sessionStorage}])")
    assert not TOKEN_PATTERN.search(dump)
```

## Sources

- [OWASP ASVS 5.0 V14 Data Protection, 14.3 Client-side Data Protection](https://github.com/OWASP/ASVS/blob/master/5.0/en/0x23-V14-Data-Protection.md)
- [OWASP HTML5 Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html)

## Related rules

- APS-16 [Lock down session cookies](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/session-cookies.md) in Application security
- APS-19 [Clear cached pages and data when someone signs out](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/clear-site-data-on-sign-out.md) in Application security
- MOB-19 [Keep tokens and keys in the Keychain or Keystore](https://agentwranglers.se/playbook/mobile-apps/data-on-the-device/keychain-keystore.md) in Mobile apps
- DSK-13 [Keep tokens in the system keychain](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps/desktop-keychain.md) in Desktop apps and extensions

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/app-ui/client-and-server-state/sensitive-data-out-of-browser-storage">Agent Wranglers web app interface playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Expect browser storage to fail or be cleared](https://agentwranglers.se/playbook/app-ui/client-and-server-state/storage-can-fail.md)
- Next: [Pause polling in hidden tabs](https://agentwranglers.se/playbook/app-ui/client-and-server-state/pause-hidden-tabs.md)
- [Client and server state](https://agentwranglers.se/playbook/app-ui/client-and-server-state.md)