I am developing a website for a bank. And they are very serious about security. I firstly get a publicKey from the server, and create a random 16bit aes iv. And then I post the iv to the server it will return me the iv and aesKey. I use this key to encryt the following requests and decrypt the data from server.I stored the iv and aesKey directly in the sessionStorage or localStorage.But they told me that not safe enough! So how should I store them.If in a ios app, I know we can store them in the keychain. But now we are in the browser. And also I saw some people say store them in memory using a javascript closure. But that will losing them when refresh the page. Do anyone know a better way?