Many resources on the internet claim LocalStorage can be unsafe as app can be prone to cross site scripting attack. If that is the case what is the safest way to store Authenticaton token, I understand cookie is another option but is it safe or not?
What they probably mean by this is that if your website falls victim to an XSS attack, the attacker can extract the tokens of your users from localStorage, because they are inherently accessible to scripts.
The same applies to most cookies, however you can set cookies to not be available to scripts, so that they are only used for sending back to the server (where the server checks them and handles auth). That way, an XSS attack cannot extract cookies that have the HttpOnly flag set from your users browsers.
While at it, also set the Secure flag of your cookie so that it is only ever transmitted over an encrypted connection.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#security
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#define_where_cookies_are_sent
In PHP 7.3 and up for example, you would use the setcookie function like this to set a Secure, HttpOnly, SameSite cookie for authentication:
setcookie("__Host-Auth-Cookie", "123-session-id", [
'expires' => time() + 12 * 60 * 60,
'path' => '/',
'secure' => true,
'httponly' => true,
'samesite' => 'Lax',
]);