I'm sort of new to Frontend programming. I'm trying to build a PWA, it stores data (client data i.e: address, name, phones) to be ready in an offline state, for which I'm using localForage. I've realised that all data stored in the browser is readable/writable by anyone (event when not logged in, as the browser's debug tool allows you to see the site's IndexedDB or WebSQL). So logically I'm now encrypting/decrypting data when storing/retrieving it, btw I'm using CryptoJS (AES with a 63 bit password). That solves that (at least for now, recomendations welcome). Now to the issue:
- AES password can be search and found using a browser's debug tool.
- Obfuscating the file/password is just wasted time and performance.
- Retrieving the password from a server is pointless as the XHR request can be debugged.
Is there no workaround this?
I'm not concerned about a legit user from accesing this data. I'm concerned about bots, malicious browser extensions, or other kinds of attacks that can read the storage by just visiting site. Not sure how likely or if this is even an attack vector.
Seems like I took too much time into thinking about this and it will be wasted time.