> First time I'm hearing that frameworks require disabling HttpOnly.
They effectively do in the case where you're using local storage because they need to grab the session token from somewhere. The thing about HttpOnly is that JS code never even gets to see the session token. Which is a mitigation for a whole class of vulnerabilities.
> ...CSRF
You have to mitigate CSRF server-side (with a CSRF token, checking the Sec-Fetch-* headers) or by using SameSite on the client side (ideally both)
There's a reason "don't use local storage for security sensitive stuff" is part of the OWASP cheatsheet[1]
They effectively do in the case where you're using local storage because they need to grab the session token from somewhere. The thing about HttpOnly is that JS code never even gets to see the session token. Which is a mitigation for a whole class of vulnerabilities.
> ...CSRF
You have to mitigate CSRF server-side (with a CSRF token, checking the Sec-Fetch-* headers) or by using SameSite on the client side (ideally both)
There's a reason "don't use local storage for security sensitive stuff" is part of the OWASP cheatsheet[1]
[1]: https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Securit...