Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not?

Thinking was along the lines of web history, bookmarks, built in password manager & cache.


Secure: HttpOnly Cookie as below is an option, but unless a User uses an addon (firebug), they cant easily access the data although access is technically possible.

Insecure: Web history doesn't appear to be a valid store as JavaScript has access to it.

Unsure: Browser bookmark

Clarification on use case:

  1. User registers for a web app (Username, Password), server only stores username & resulting passphrase encoded key.
  2. User redirected to a confirmation page, with their resulting passphrase encoded key. (Secure storage applies here.)
  3. User logs in with their Username, Password & Passphrase encoded key. Password decodes key which is used for encryption.


  • Password is hardended using a password strengthing algorithm into a passphrase.
  • Storage should be optional and use should have a way to opt in/out. (Using Bookmark, this could be as simple as click here to bookmark the passphrase.)
  • No server side logging on the login & confirmation pages. (Caching will be disabled)
  • All communication over SSL/TLS
  • 1
    This magical place you are referring to is called the "server".
    – user10211
    Aug 18, 2013 at 10:43
  • 1
    @Terry Chia, thanks but javascript has access to everything a user does via ajax, so this doesnt answer the question. Secondly I was refering specifically to a web browser. (Client side apps)
    – Null
    Aug 18, 2013 at 10:46

1 Answer 1


The only thing that fits your requirements is HttpOnly cookies. They can be normally exchanged in the HTTP headers, can be easily accessed by the user (you know, being client-side), but it is enforced by all major browsers that these cookies cannot be accessed by normal JavaScript running in the page (for example, document.cookie).

A closer look at your question shows that you already understand that if something is in the browser, it will be accessed by the user and there's nothing you can do about it. In the case of HttpOnly cookies, the browser itself regulates access to them and it imposes strict security rules preventing normal JavaScript code from accessing them. Addons and plugins have normal unregulated access to these cookies because they run on a higher "security clearance level".

  • The easiest way I can think of to fit the "access by the user" part is providing a page which prints out the current value of the cookie, for the user to edit. It's likely that breaks the security model aimed for, though, and such a page would be accessible to Javascript.
    – Katana314
    Aug 19, 2013 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .