React + Express JWT auth works in same tab but logs out in new tab (sessionStorage issue?)

Hi everyone,

I’m using React (Vite) + Node/Express with JWT authentication.

Issue:

• Login works correctly
• Page refresh works in the same tab
• But when I open the same app URL in a new tab, it redirects to login

Here’s how I’m storing tokens:

function storeTokens(
  accessToken: string,
  refreshToken: string,
  staySignedIn: boolean
) {
  const storage = staySignedIn ? localStorage : sessionStorage;

  storage.setItem("accessToken", accessToken);
  storage.setItem("refreshToken", refreshToken);
}

Login:

const { data } = await apiClient.post("/auth/login", payload);

storeTokens(
  data.accessToken,
  data.refreshToken,
  payload.staySignedIn || false
);

If staySignedIn is false, tokens go to sessionStorage.

My understanding:

• sessionStorage is tab-specific
• localStorage is shared across tabs

Is this expected behavior because of sessionStorage?
What’s the recommended production approach here?

• Always use localStorage?
• Switch to HTTP-only cookies?
• Hybrid approach?

Would appreciate guidance on best practice for JWT persistence across tabs.