Securing NodeJS Backend as well as my React-Frontend (using Auth0-Lock)?

We don’t recommend keeping access tokens in localstorage due to the possibility of XSS attacks. The Auth0 React SDK should be handling all of that for you, and I would highly recommend it vs implementing yourself.