Ask HN: Is using/storing id tokens in the browser considered save now?

Looking at the firebase documentation it seems it is simply possible for the client side javascript to obtain the odic id token via getIdToken.

A few years ago this was considered unsave and instead sessions should be used an the session Id should be replaced by the JWT token on the server side.

I'm wondering what is the current best practice?