Session tokens stored in localStorage in Firebase

Do not copy the ID token into your own storage. browserLocalPersistence stores the SDK's auth state in localStorage, and LOCAL is the web default. If your own API needs to know who the caller is, verify the token on the server for that request. Do not write localStorage.setItem('token', idToken) on top of the SDK.

The Auth interface says signOut does not automatically revoke the user's ID token. A copy you placed in localStorage can still be sent to your API after the SDK user is cleared. Delete that key on logout, and treat a token that already left the browser as usable by whoever has it until it expires.

browserCookiePersistence is documented for hybrid rendering and middleware. Firebase marks it as a public preview and says not to use that API in a production environment. It is not the fix to ship while that warning stands.