> Discord removes it on page load and restores it when the tab is closed.

How does this work? You have no real control over what the browser does when it closes a tab.

Except you do. https://developer.mozilla.org/en-US/docs/Web/API/Window/unlo...

What happens if you lose power? You're logged out because it didn't save the token back. Verified this by pausing JS execution and killing Firefox. (the local storage key is "token")

I've always wondered how they do it as well.

Second problem - if they remove it from localstorage they still need to hold them somewhere. So are they moved to a simple variable then? It's just as accessible as localStorage. Maybe it's randomized every load?

> I've always wondered how they do it as well.

See https://news.ycombinator.com/item?id=48574402

> So are they moved to a simple variable then?

Yup, it has to exist somewhere.