JWT token should be stored securely if they are used as auth for browser users.

[h4cker39]

If an application are using JWT in browsers it should be stored securely in a cookie which requires:

• Require SSL on the comunication
• Enable HttpOnly
• Send The Cookie To Only Your Application