Is encrypting localStorage data more secure?

Question

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad idea because of XSS attacks or a user could be socially engineered to go to the console, get the token and give it away.

So I use this JavaScript library called 'secure-ls', which uses localStorage but encrypts the data. The encryption key is randomly generated for each instance of the application, so I don't store it as plain text in the code.

This is what it looks like:

private static _instance: SecureStorage = new SecureStorage({
    encryptionSecret: crypto.randomBytes(60).toString(),
});

This is what the encrypted data in the console looks like:

The plain-text data in localStorage is only available to the code. I believe this is sufficiently secure and I can't see how a hacker could get the plain-text data.

So it leaves me to wonder why more people don't use this method? Or is there some loophole I'm missing in how a hacker could get the data?

Answer 1

An attacker has full control over the client, and therefore has complete access to the encryption keys and methods. In short, this cannot actually protect anything from an attacker.

Normally client-side encryption at least provides a small layer of protection to slow down attackers, but protections around client-side JavaScript tend to be the easier to circumvent than similar steps in apps or desktop applications.

It is unlikely to be helpful