Who has access to data stored in local storage, session storage, and cookies?

Data in localStorage and sessionStorage are accessible only to scripts running on the same domain as the page, according to the same-origin policy. This means that other sites cannot access this data.

• localStorage stores data without expiration and is accessible only from the same domain.
• sessionStorage stores data only for the duration of the browser tab session and is also accessible only from the same domain.

Cookies can be accessible both on the client side (via JavaScript) and on the server side if they are sent with HTTP requests. Cookie accessibility depends on settings:

• The HttpOnly flag prevents access via JavaScript, making cookies accessible only to the server.
• The Secure flag restricts cookie transmission to HTTPS only.
• The SameSite flag controls whether cookies are sent with cross-site requests, helping to prevent CSRF attacks.

Thus, access to data:

• localStorage/sessionStorage: only scripts from the same domain.
• Cookies: accessible to the server and, if HttpOnly is not set, to client-side JavaScript from the same domain.