Use cookies only when the server needs the value on every request, and set HttpOnly, Secure and SameSite for anything sensitive. Use sessionStorage for state that should die with the tab, localStorage for small synchronous key value data that survives restarts, and IndexedDB for anything large, structured or asynchronous. Never keep tokens or personal data in localStorage, since any script on the page can read it.
Why interviewers ask this
This looks like a trivia question but it is really a security question. The interviewer wants to see that you know localStorage is readable by any injected script, that localStorage is synchronous and therefore blocks the main thread, and that cookies cost bandwidth on every single request. Knowing when IndexedDB is worth the complexity also signals you have built something offline capable rather than only CRUD screens.
How to structure your answer
- Sort the options by what the server needs versus what only the client needs.
- Call out that localStorage is synchronous and same origin readable.
- State the token rule and the cookie flags you set.
- Say where IndexedDB earns its complexity.
Example answer
My first question is whether the server needs it. If it does, it is a cookie, and it gets HttpOnly, Secure and SameSite, which also means it is not something my JavaScript reads. If only the client needs it, then it comes down to lifetime and size. sessionStorage for things scoped to the tab, like a wizard step or a scroll position I do not want leaking into another tab. localStorage for small durable preferences, theme, last used filter, that sort of thing, and I keep it small because it is synchronous, so a large JSON blob parsed on startup shows up directly in my time to interactive. IndexedDB once the data is big or structured, for example a cached list of records for offline use, usually behind a small wrapper because the raw API is unpleasant. The rule I will not bend is that access tokens do not go in localStorage, because any injected script can read them; those live in an HttpOnly cookie or in memory only.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- Why is an HttpOnly cookie safer than localStorage for a session token?
- How would you keep two open tabs in sync with the same stored state?
- What are the storage limits and eviction rules you plan around?
Related frontend developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions