But the browser lets you store credentials in local storage, what’s the problem?

You're not asking this seriously arent you? Local storage follows strict security policies, go read the spec