Comparison questionMedium~10 minBrowser Rendering, CSS & Storage / 4 of 5

Interview question

How would you choose among cookies, localStorage, sessionStorage, and IndexedDB for browser data?

Chooses browser storage by server transport, lifetime, capacity, query needs, sensitivity, synchronization, and offline behavior.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Cookies are small values the browser can send with matching HTTP requests, so they suit server sessions when configured securely. sessionStorage is scoped to a tab session, while localStorage persists for the origin and exposes a synchronous string API. IndexedDB is asynchronous and better for larger structured or offline data. I choose based on lifetime, size, access pattern, and security.

Full answer below

Practice focus

Practical storage judgment that keeps client persistence separate from trust and authorization.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
The choice begins with who needs the data and how long it should live. No browser store turns client-controlled data into trusted state.
Cookies are small values the browser can send with matching HTTP requests, so they suit server sessions when configured securely. sessionStorage is scoped to a tab session, while localStorage persists for the origin and exposes a synchronous string API. IndexedDB is asynchronous and better for larger structured or offline data. I choose based on lifetime, size, access pattern, and security.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I avoid placing sensitive bearer tokens in script-readable storage when an HttpOnly secure cookie session is available, while still handling CSRF for automatically sent credentials. Preferences may fit local storage; a recoverable draft may fit session storage; an offline catalog or queued work may justify IndexedDB. Every value remains untrusted when sent back to the server.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I define expiry, schema migration, quota failure, multi-tab behavior, deletion, and privacy controls. Synchronous Web Storage can block the main thread when overused, and IndexedDB adds transaction and versioning complexity. Offline writes also need conflict and replay rules. I minimize persisted data and design graceful recovery because users can clear storage, browsers can evict it, and deployment versions can disagree about its schema.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Choosing storage only by maximum capacity.
Treating local storage as a secure credential vault.
Trusting browser data because the application originally wrote it.
Ignoring schema versioning and quota failure.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Authorization depends on a client-stored role or price.
Long-lived sensitive data is script-readable without a threat-model decision.
Offline writes have no conflict or replay behavior.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When is an HttpOnly cookie preferable?
Why can local storage affect responsiveness?
How would you migrate IndexedDB data?

Continue the section

Next in Browser Rendering, CSS & Storage: Stale assets after deployment

Step 5 of 5

Some users receive an old HTML shell with new assets, or a new shell that requests deleted chunks after deployment. How would you diagnose and prevent it?

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Was this drill useful?