Thank you for this great summary. There is one thing that tripped me up whilst creating an application that was embedded inside another site within an iFrame. If a user disables Third Party Cookies, then the Web Storage API is not accessible. Even though it's not a cookie, and that the parent site cannot access the cookies inside of an iframe, it's still blocked.

However, please note that sensitive, private data like JWTs should be handled with care and not stored in Web Storage because it can be accessible by anyone.

There isn't anything wrong in storing jwt/jwe in localStorage.

Thank you Akinleye Oyinbayode Peters