Questions tagged [local-storage]
The local-storage tag has no usage guidance.
59
questions
0
votes
1
answer
2k
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
0
votes
0
answers
84
views
In a web application, what would you consider the best way to store secret keys obtained via an SDK?
Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user.
Currently when ...
- 1
0
votes
3
answers
237
views
Do browser vendors have access to LocalStorage/cookies?
Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
- 103
0
votes
2
answers
1k
views
Storing sensitive data in Local Storage with encryption?
I have a notes app that's offline-first and syncs with remote database when online.
Currently, when a user creates a note, I'm encrypting it with AES. I ask the user to enter their decryption ...
- 1
0
votes
0
answers
4k
views
Where to store token from auth header in React
I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
- 101
0
votes
0
answers
20
views
Store login credentials securely with JavaScript [duplicate]
Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically.
For this, our application saves the ...
- 174
1
vote
1
answer
1k
views
JWT cookie with CSRF token as a claim inside the JWT
I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection,
I would like to store the JWT in an httpOnly & secure cookie and not in local storage,
when ...
- 113
3
votes
1
answer
394
views
Cookies VS localStorage (JavaScript Security)
I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
- 269
7
votes
1
answer
4k
views
Logging in as another user - Security Issue
Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
- 87
1
vote
0
answers
627
views
Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)
In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off?
Or, more ...
2
votes
0
answers
968
views
Progressive web app, Access token storage
I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
- 21
0
votes
1
answer
257
views
How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]
The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite.
Question
When physical disk destruction is ...
- 1,250
1
vote
1
answer
1k
views
How to best store the password for Keepass for a python bot that runs in Windows?
I have a python bot that runs in Windows 10 and accesses Keepass with a password.
I'm wondering what would be the correct way to store and access this Keepass password.
Currently, the Keepass password ...
- 205
0
votes
0
answers
98
views
Should you even bother trying to hide authentication from XSS?
I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
- 1
0
votes
1
answer
280
views
Is storing a short lived JWT on initial login in LocalStorage safe?
I was reading this question and still have doubts about my use case.
I know it's unsafe to store a JWT in local/session storage due to XSS attacks. But what if it's for a JWT that only lasts 1 min ...
- 101
3
votes
1
answer
851
views
What's wrong with storing a username and password as a cookie?
I'm working on a legacy application that issues JWTs with a short expiry time.
They do not have refresh token functionality implemented.
So obviously while using refresh tokens would be the right ...
- 717
9
votes
1
answer
782
views
Are Javascript closures a useful technique to limit exposing data to XSS?
I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
- 193
0
votes
0
answers
200
views
Ionic local storage store sensitive data for private app
I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
- 1
2
votes
2
answers
251
views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
- 121
1
vote
1
answer
585
views
How to store private keys in browsers after Apple's decision to wipe script-writeable storage?
We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple.
The TLDR; ...
- 113
1
vote
1
answer
803
views
Is it a security risk to strore item IDs in sessionStorage?
I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store.
Looking at lots of other posts, it is clear to me that there are ...
- 11
1
vote
1
answer
1k
views
Is encrypting localStorage data more secure?
I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
- 111
-3
votes
1
answer
177
views
What led to the prominence of storing JWTs in localstorage?
Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
- 149
1
vote
1
answer
2k
views
Storing encrypted tokens in LocalStorage
I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service.
The app ...
- 111
2
votes
2
answers
4k
views
Is LocalStorage in web browsers safe enough to store passwords?
I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
- 171
2
votes
1
answer
2k
views
How is security risk of storing authentication token in localStorage compared with cookies?
I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
- 165
3
votes
1
answer
136
views
What data related to a specific web page can be obtained outside the browser?
The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
- 33
4
votes
2
answers
1k
views
Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?
In the context of a web application...
should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
- 2,260
2
votes
1
answer
101
views
Data extraction, temporary storage and audit log - Advice needed
At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
- 71
3
votes
0
answers
2k
views
How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?
Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
a browser game in which the player's level and progress are to be saved locally.
a game,...
- 131
10
votes
1
answer
3k
views
Authentication with JWT
I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement:
...
- 205
1
vote
2
answers
270
views
Why are third party cookies sent to second party websites?
When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request.
This goes against my whole understanding of cookies which is that cookies are only ...
- 579
27
votes
2
answers
26k
views
Is it safe to store a JWT in sessionStorage? [duplicate]
This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage)
So, ...
- 379
59
votes
4
answers
15k
views
Is the OWASP recommendation regarding localstorage still valid?
I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS.
For authentication, we are using Auth0. The Auth0 documentation ...
- 2,496
0
votes
1
answer
3k
views
localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?
If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship:
Auth server <-----------> Client (browser) <-----------> App API server
The ...
- 153
2
votes
1
answer
6k
views
Storing Username in sessionStorage: bad idea?
I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
- 223
-1
votes
1
answer
159
views
How can MyKi transfer data from iOS to macOS without a server?
MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible?
"Your sensitive data is ...
- 139
1
vote
1
answer
3k
views
Cookie vs HTML5 localStorage
On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc).
https://www.w3schools....
- 5,245
3
votes
0
answers
1k
views
Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?
We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
- 237
0
votes
1
answer
151
views
Store password in Chrome exclusively online
I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
- 433
0
votes
1
answer
460
views
Can I store secrets in localStorage? Will malware have access to it?
If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?
- 109
2
votes
1
answer
1k
views
Storing privacy sensitive data in a local application [closed]
We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
- 121
2
votes
1
answer
672
views
How to handle OAuth2 refresh_token for sessionless login?
I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
- 333
2
votes
1
answer
165
views
Proper way of archiving malicious files
I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files?
Given that the files won´t be executed (...
- 996
3
votes
1
answer
12k
views
JWT tokens size problem
I'm developing a single-page-app that interacts with an oAuth based service. This service grants JWT tokens (refresh and access) for a lot of resources. Potentially the number of tokens can be ...
- 33
6
votes
1
answer
8k
views
How to securely store accesstoken in android
I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application.
In this case, the local storage ...
- 1,452
3
votes
2
answers
569
views
Checking a locally stored string for tamper
I'm working on a multiplayer game using WebSockets. I've decided all user data will be stored on the client, eliminating the need for authentication using passwords etc.
LocalStorage
'save' -> '{"...
- 133
3
votes
1
answer
6k
views
How secure is HTML5 web storage (sessionStorage and localStorage)?
I'm thinking of using either sessionStorage or localStorage to store some important user data.
The extension's functionality will only work in the context of a particular website that defaults to ...
- 171
1
vote
1
answer
382
views
Can LastPass local password store (on a Android device) be brute forced in a usual way?
I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device.
...
- 113
0
votes
0
answers
563
views
Is keeping business data in browser database websql secure?
Knowing that
Server always validates the data before saving it.
Browser app is generating the data based on user input and some business logic and is storing it locally.
Browser app then synchronize ...
- 893