Sessions use HTTP-only, SameSite cookies set by the server — tokens are never stored in localStorage.
Learn more