Store user tokens in HttpOnly cookies to prevent them from being accessible via JavaScript (protection against XSS).