Is it safe to save token in localStorage ?

[slashtu]

localStorage can be accessed by JS, How to prevent XSS attacks?

[sebadoom]

Indeed. Switching to cookies is the right way of dealing with this. You would still need to sort out CSRF issues, but those can be dealt with in a safer way.

[lnpbk]

@slashtu If a token is modified, it fails decryption on the server-side, which can be caught before any sensitive data is returned.

[hegdeashwin]

If you are using your application on iOS Safari in private mode ... HTML 5 storage feature will not work ... 1 more reason to use cookie instead of local storage in case your web app. is supporting devices