Can someone explain the Cookie vs LocalStorage thing? You can access cookies from Javascript, so how is localstorage worse? Assuming an attacker can execute arbitrary js in the browser (the model provided by the article).
edit: Thanks for the answers - httponly, makes sense.
edit: Thanks for the answers - httponly, makes sense.