1

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage, before redirecting the user to the signup page.

The signup page then checks the LocalStorage and autofills the email and password from the previous page.

My question is, how safe is LocalStorage for storing that type of data? Storing RAW passwords in this fashion seems like it could be a bad idea. That being said, it is all local on the users device. It isn't being sent to any server or anything, so the chance of attack is reduced.

I've also considered deleting the item from LocalStorage after retrieving it on the signup page. Which would make it safer.

How secure is LocalStorage for storing RAW passwords and this type of data?

  • Never let the website autofill passwords, always leave it up to the user's keychain / password manager. – Leo Adberg May 10 at 1:11
  • it's fine and harmless, unless you suffer some other kind of breach like XSS or server takeover. – dandavis May 10 at 17:15
  • @LeoAdberg: a password manager gives the page's JS access to the password when it populates the password input field. a rouge script can get it there just like from localStorage. – dandavis May 10 at 17:20
3

Terrible idea. Don't store the password in clear text between pages, not on the client and not on the server. Redesign your page flow (for instance by only entering the user name on the first login page, then branch to the registration page if it does not exist), or if you can't, let them re-enter the password.

1

You shouldn't store the password in LocalStorage for the following reasons:

  • LocalStorage contents stay there forever if you don't delete it. If a user clicks the login button and then decides not to sign up and instead closes the window, the password won't be deleted from LocalStorage.
  • Storing paswords in plain-text is generally a bad idea. It doesn't matter where you store it, when it's plain-text(LocalStorage, SessionStorage, Server).

Possible solutions to the problem:

  • When an user clicks the login button, you may directly hash(+salt) the password at the server and store it in the user's session(session data is stored at the server). You should then save the hashed password and salt to the database, when the user submits the sign up form. While this solution is possible from the technical point of view, you should avoid it because it's very strange from the usability view as it's an uncommon behaviour.

  • As Brezelbub mentioned, you may use the "Google-Login"-flow:

    • User enters email-address
    • If email-address isn't already registered, redirect to sign up page and autofill email, otherwise show login page with pre-filled email-field.
  • Show a signup button/link below your login form. This is the most popular way to do it.

I hope this answer is helping you at choosing an usable & secure login/sign-up design.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.