Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [local-storage]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
81 views

how to send cookies or token in local storage to a remote server using reflected XSS

I have an XSS vulnerability identified by <script>alert(1);</script> in the url. So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
anonymous's user avatar
0 votes
1 answer
86 views

Password-based encryption: keeping the user logged in without entering password again

Context I have a system where some of user's data is encrypted via AES. Each user has their own key K. When the user creates an account, the K is generated and encrypted with a key derived from ...
v_slav.b's user avatar
2 votes
0 answers
97 views

Secure API token handling in Windows app: the token is needed to authenticate the requests to a backend server

I'm currently working on a UWP app that involves validating redemption codes against a Cloudflare KV storage backend. That's all the backend server is for. I want the app to check the redemption code ...
Neox's user avatar
  • 21
2 votes
1 answer
500 views

Apple Mail versus GMail app content security

I am trying to determine if there is a benefit to using the GMail app over the built in iOS one when it comes to security. I know that both store data locally on the phone, but the question is whether ...
Justin Pihony's user avatar
1 vote
1 answer
9k views

Where to store JWT refresh tokens

Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
simple_developer's user avatar
0 votes
0 answers
155 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
Ray's user avatar
  • 1
0 votes
3 answers
384 views

Do browser vendors have access to LocalStorage/cookies?

Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
peirix's user avatar
  • 103
0 votes
2 answers
2k views

Storing sensitive data in Local Storage with encryption?

I have a notes app that's offline-first and syncs with remote database when online. Currently, when a user creates a note, I'm encrypting it with AES. I ask the user to enter their decryption ...
Wor Chan's user avatar
0 votes
0 answers
4k views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
NoDiggityNoDoubt's user avatar
0 votes
0 answers
20 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
Tom's user avatar
  • 174
1 vote
1 answer
1k views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
Roie Beck's user avatar
  • 113
3 votes
1 answer
516 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
Parking Master's user avatar
7 votes
1 answer
4k views

Logging in as another user - Security Issue

Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
galos79241's user avatar
1 vote
0 answers
774 views

Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off? Or, more ...
WHO'sNoToOldRx4Covid-CENSORED's user avatar
2 votes
0 answers
1k views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
Bart Mommens's user avatar
0 votes
1 answer
395 views

How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite. Question When physical disk destruction is ...
stevec's user avatar
  • 1,280
1 vote
1 answer
1k views

How to best store the password for Keepass for a python bot that runs in Windows?

I have a python bot that runs in Windows 10 and accesses Keepass with a password. I'm wondering what would be the correct way to store and access this Keepass password. Currently, the Keepass password ...
AturSams's user avatar
  • 205
0 votes
0 answers
124 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
Roy He's user avatar
  • 1
0 votes
1 answer
338 views

Is storing a short lived JWT on initial login in LocalStorage safe?

I was reading this question and still have doubts about my use case. I know it's unsafe to store a JWT in local/session storage due to XSS attacks. But what if it's for a JWT that only lasts 1 min ...
tbd_'s user avatar
  • 101
3 votes
1 answer
980 views

What's wrong with storing a username and password as a cookie?

I'm working on a legacy application that issues JWTs with a short expiry time. They do not have refresh token functionality implemented. So obviously while using refresh tokens would be the right ...
dwjohnston's user avatar
9 votes
1 answer
888 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
user avatar
0 votes
0 answers
230 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
hacek's user avatar
  • 1
2 votes
2 answers
282 views

What wrong with this system to proactively check if customers' passwords have been found in a breach?

Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
Han Seoul-Oh's user avatar
1 vote
1 answer
634 views

How to store private keys in browsers after Apple's decision to wipe script-writeable storage?

We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple. The TLDR; ...
reedvoid's user avatar
  • 113
2 votes
1 answer
997 views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...
Josh Bounce's user avatar
1 vote
1 answer
1k views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
chinloyal's user avatar
  • 111
-3 votes
1 answer
200 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
jia chen's user avatar
  • 149
1 vote
1 answer
2k views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
oogles's user avatar
  • 111
2 votes
2 answers
4k views

Is LocalStorage in web browsers safe enough to store passwords?

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
Charlie Fish's user avatar
2 votes
1 answer
2k views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
Milkyway's user avatar
  • 165
3 votes
1 answer
161 views

What data related to a specific web page can be obtained outside the browser?

The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
Denis's user avatar
  • 33
5 votes
2 answers
2k views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
itscooper's user avatar
  • 2,280
2 votes
1 answer
123 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
bluffmast3r's user avatar
3 votes
0 answers
3k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
Steve06's user avatar
  • 131
10 votes
1 answer
4k views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
Ilya's user avatar
  • 205
1 vote
2 answers
339 views

Why are third party cookies sent to second party websites?

When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request. This goes against my whole understanding of cookies which is that cookies are only ...
CodyBugstein's user avatar
27 votes
2 answers
26k views

Is it safe to store a JWT in sessionStorage? [duplicate]

This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage) So, ...
Ghassan Karwchan's user avatar
59 votes
4 answers
16k views

Is the OWASP recommendation regarding localstorage still valid?

I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS. For authentication, we are using Auth0. The Auth0 documentation ...
JMK's user avatar
  • 2,506
0 votes
1 answer
3k views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
M Miller's user avatar
  • 153
2 votes
1 answer
7k views

Storing Username in sessionStorage: bad idea?

I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
strumpy_strudel's user avatar
-1 votes
1 answer
178 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
FooBar's user avatar
  • 139
1 vote
1 answer
4k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
OscarAkaElvis's user avatar
3 votes
0 answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
Jacobian's user avatar
  • 247
0 votes
1 answer
172 views

Store password in Chrome exclusively online

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
KB303's user avatar
  • 433
0 votes
1 answer
489 views

Can I store secrets in localStorage? Will malware have access to it?

If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?
golopot's user avatar
  • 109
2 votes
1 answer
1k views

Storing privacy sensitive data in a local application [closed]

We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
Wouter's user avatar
  • 121
2 votes
1 answer
693 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
jwerre's user avatar
  • 333
2 votes
1 answer
188 views

Proper way of archiving malicious files

I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (...
architekt's user avatar
  • 996
3 votes
1 answer
13k views

JWT tokens size problem

I'm developing a single-page-app that interacts with an oAuth based service. This service grants JWT tokens (refresh and access) for a lot of resources. Potentially the number of tokens can be ...
Nir Smadar's user avatar
6 votes
1 answer
8k views

How to securely store accesstoken in android

I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application. In this case, the local storage ...
Anonymous Platypus's user avatar