# Requirements Clarification Questions — CMS Frontend

I detected a contradiction in your responses that needs clarification:

## Contradiction: Authentication Security vs. Security Baseline

You indicated **JWT in localStorage** (Q2: A) but also **Enforce all SECURITY rules as blocking constraints** (Q11: A).

Storing JWT tokens in `localStorage` is a known security vulnerability — XSS attacks can steal tokens from localStorage. When the Security Baseline extension is enforced, this pattern is typically flagged as a **blocking security finding**.

This means either:
- The security baseline must be applied → the localStorage auth approach cannot be used
- The localStorage auth approach is acceptable → security baseline must be relaxed or skipped

### Clarification Question 1
How should this contradiction be resolved for the cms-frontend project?

A) Use a secure authentication approach (access token in memory + refresh token in httpOnly cookie) AND keep the security baseline enforced — this is the secure production-ready choice
B) Keep localStorage for now (faster to implement, familiar) AND disable the security baseline — acceptable for a prototype/development phase
C) Keep localStorage for now AND keep the security baseline, but acknowledge and document this as an accepted risk / technical debt
X) Other (please describe after [Answer]: tag below)

[Answer]: