Is it a security risk to strore item IDs in sessionStorage?

Question

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store.

Looking at lots of other posts, it is clear to me that there are definite security risks from using sessionStorage/localStorage techniques in order to store data on the clients side which can lead to XSS attacks or will not work properly on some clients. My goal is to be able to store an ID relating to an item when the user adds an item to the basket.

I'm not going to be storing any price data or other information just the item ID, on the server side I would then take the item IDs from the session storage and it would do a cross reference from the session data where the IDs match.

Although I feel as if I mostly understand the security risk should I be taking a different approach or is it okay to use sessionStorage? Would it be useful to maybe use some sort of encryption method so that the item ID is not directly known on the frontend and then decoded on the backend? My site is using express node.

Answer 1

Depends how exactly they are used.

The questions you should be asking yourself are:

• What is the risk if a user modifies the ID?
• By modifying an ID, can a user access any items they shouldn't have access to (are the IDs validated on the server-side, possiblity checked for authorization if needed)?
• Is the application prepared to handle invalid input (e.g. given a string when expecting a number)?
• Does the data get displayed to other users, and if so, is it validated/sanitized?
• If the application uses a database, does the ID end up in a SQL query, allowing for injection?

If you can answer the above without raising any concerns, then you are likely fine. Just treat the field like any other untrusted user input, and make sure any validation ultimately happens on the server-side.

If nothing can learned or gained by brute-forcing IDs, I see no reason to obfuscate them.