1. Don't put sessions in localstorage, use a cookie with the Secure and HttpOnly settings. They are then inaccessible to JavaScript.
2. Add a Content Security Policy to your headers. Start very tight i.e. default-src 'none'; style-src 'self'; img-src 'self'.
There's a really great PenTest checklist here https://pentestbook.six2dez.com/others/web-checklist So you can see it from the attackers perspective.
The takeaway I'd suggest instead is that when one gets a pen test report back with a bunch of lower-severity issues, fix them instead of deciding that anything "medium" or below gets put on the backlog, because frequently a bunch of lower-severity vulns can be chained together like this to yield something much more dangerous.
What is wrong with cookie authentication?
Using token auth headers can avoid the use of csrf tokens and make your backend only require a single type of auth.