XSS attacks can steal tokens

[Toerktumlare]

Storing tokens in memory is a huge security risk when it comes to XSS-attacks.

If a malicious actor manages to perform such an attack, the actor can use the clients token, and do whatever requests that are allowed for the current logged in user. This is why sessions cookies are used with the httpOnlyflag active so that javascript cant reach the session-cookie.

Storing the token so that it is reachable by javascript is extremely dangerous.

OWASP cheat sheet writes:

Do not store session identifiers in local storage as the data is always accessible by JavaScript. Cookies can mitigate this
risk using the httpOnly flag.

The same recommendation goes for the ApolloClient in memory cache.

Using JWT as a "session replacement" is in general bad practice:

As to why can be read here.

Stop Using JWT For Sessions
Stop Using Jwt For Sessions part 2 why your solution doesnt work

Here are some general good practices for JWT
JWT best practices