Roadmap › JavaScript (ES5 → ES2025) & TypeScript Basics › Module: Browser and DOM
Lessons in this course (16)
12. Storage, fetch, CORS and browser APIs
IntermediateMediumLesson 12 of 16
| Storage | Capacity | Lifetime | Sent to server |
|---|---|---|---|
| Cookies | ~4 KB | Expiry date | Yes, with every request |
localStorage | ~5–10 MB | Until cleared | No |
sessionStorage | ~5 MB | Tab session | No |
| IndexedDB | Large (quota-based) | Until cleared | No — async, structured data |
| Cache API | Large | Until cleared | No — service workers/PWA |
Never store auth tokens in localStorage if you can avoid it (readable by any XSS); prefer HttpOnly; Secure; SameSite cookies or a BFF.
Other APIs: fetch, AbortController, IntersectionObserver (lazy load, infinite scroll), ResizeObserver, MutationObserver, Web Workers, Service Workers (offline/PWA), WebSockets, history.pushState (SPA routing), Clipboard, Geolocation, Notifications.
CORS — the browser blocks reading cross-origin responses unless the server sends Access-Control-Allow-Origin; preflight OPTIONS for non-simple requests. It's fixed on the server, not in JS.