What's the best way to do authentication in modern applications

A seemingly simple question — where should apps keep your login proof so bad actors can’t grab it — turned into a full-on internet food fight. In the article, Neciu Dan walks readers through the big choices: keeping it in the browser’s storage, keeping it only temporarily, or using old-fashioned browser cookies. His big message is that the web is a hostile place, and the safest answer for most normal apps is often the least glamorous one: let the browser handle it in a more traditional way.

But the comments? Absolutely feral. One camp basically yelled, “Congrats, we reinvented 2005,” with veterans gleefully pointing out that there’s a reason mature websites settled on cookies ages ago. Another crowd was less interested in the security debate and more interested in dragging the article itself, with multiple commenters accusing it of sounding like AI slop. One brutal jab summed up the mood: don’t use modern token hype for everyday logins, and maybe don’t outsource your writing to a chatbot either.

There was also a stubborn rebel faction defending browser storage, arguing that if a bad actor can already run code in your page, you’ve got bigger problems than where the login proof lives. That clash — boring and safe vs flexible and practical — became the real show. The funniest running joke? After all the fancy modern talk, the crowd’s verdict was basically: the “boring” old stuff still works, and everyone is mad about it.