Use cookie
With jwt, the easiest option is to use cookies. The advantage of cookies is that they can be set when they expire. Resolve the issue of time validation accordingly. Create a token on the server, write to the server in the cookie with the date of delay. In this case, the client doesn't need to do anything at all.
Use sessionStorage
After authorization, write the token to sessionStorage and as long as the tab is live, the token will also live. And, of course, there will not be a token in another tab, and, accordingly, the client will not be authorized.
localStorage
localStorage will always store the token. But this should not be. Because with each Ajax request the token should be checked . And, accordingly, with 401 deleted, and after authorization overwritten again.