2

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage, before redirecting the user to the signup page.

The signup page then checks the LocalStorage and autofills the email and password from the previous page.

My question is, how safe is LocalStorage for storing that type of data? Storing RAW passwords in this fashion seems like it could be a bad idea. That being said, it is all local on the users device. It isn't being sent to any server or anything, so the chance of attack is reduced.

I've also considered deleting the item from LocalStorage after retrieving it on the signup page. Which would make it safer.

How secure is LocalStorage for storing RAW passwords and this type of data?

Improve this question
3
  • 1
    Never let the website autofill passwords, always leave it up to the user's keychain / password manager.
    – Leo Adberg
    Commented May 10, 2019 at 1:11
  • it's fine and harmless, unless you suffer some other kind of breach like XSS or server takeover.
    – dandavis
    Commented May 10, 2019 at 17:15
  • @LeoAdberg: a password manager gives the page's JS access to the password when it populates the password input field. a rouge script can get it there just like from localStorage.
    – dandavis
    Commented May 10, 2019 at 17:20

2 Answers 2

Reset to default
2

Terrible idea. Don't store the password in clear text between pages, not on the client and not on the server. Redesign your page flow (for instance by only entering the user name on the first login page, then branch to the registration page if it does not exist), or if you can't, let them re-enter the password.

Improve this answer
1

You shouldn't store the password in LocalStorage for the following reasons:

  • LocalStorage contents stay there forever if you don't delete it. If a user clicks the login button and then decides not to sign up and instead closes the window, the password won't be deleted from LocalStorage.
  • Storing paswords in plain-text is generally a bad idea. It doesn't matter where you store it, when it's plain-text(LocalStorage, SessionStorage, Server).

Possible solutions to the problem:

  • When an user clicks the login button, you may directly hash(+salt) the password at the server and store it in the user's session(session data is stored at the server). You should then save the hashed password and salt to the database, when the user submits the sign up form. While this solution is possible from the technical point of view, you should avoid it because it's very strange from the usability view as it's an uncommon behaviour.

  • As Brezelbub mentioned, you may use the "Google-Login"-flow:

    • User enters email-address
    • If email-address isn't already registered, redirect to sign up page and autofill email, otherwise show login page with pre-filled email-field.

  • Show a signup button/link below your login form. This is the most popular way to do it.

I hope this answer is helping you at choosing an usable & secure login/sign-up design.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .