Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [local-storage]

The tag has no usage guidance.

1
vote
1answer
38 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
0
votes
0answers
69 views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
3
votes
1answer
340 views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
1
vote
2answers
84 views

Why are third party cookies sent to second party websites?

When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request. This goes against my whole understanding of cookies which is that cookies are only ...
3
votes
2answers
3k views

Is it safe to store a JWT in sessionStorage? [duplicate]

This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage) So, ...
40
votes
4answers
5k views

Is the OWASP recommendation regarding localstorage still valid?

I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS. For authentication, we are using Auth0. The Auth0 documentation ...
0
votes
1answer
584 views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
1
vote
1answer
1k views

Storing Username in sessionStorage: bad idea?

I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
-1
votes
1answer
72 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
1
vote
1answer
2k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
1
vote
0answers
291 views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
0
votes
1answer
106 views

Store password in Chrome exclusively online

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
0
votes
1answer
172 views

Can I store secrets in localStorage? Will malware have access to it?

If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?
2
votes
1answer
380 views

Storing privacy sensitive data in a local application [closed]

We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
2
votes
1answer
363 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
3
votes
1answer
107 views

Proper way of archiving malicious files

I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (...
0
votes
1answer
2k views

JWT tokens size problem

I'm developing a single-page-app that interacts with an oAuth based service. This service grants JWT tokens (refresh and access) for a lot of resources. Potentially the number of tokens can be ...
3
votes
1answer
3k views

How to securely store accesstoken in android

I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application. In this case, the local storage ...
3
votes
2answers
266 views

Checking a locally stored string for tamper

I'm working on a multiplayer game using WebSockets. I've decided all user data will be stored on the client, eliminating the need for authentication using passwords etc. LocalStorage 'save' -> '{"...
4
votes
1answer
5k views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
1
vote
1answer
185 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
0
votes
0answers
336 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
1
vote
0answers
93 views

Storing user private key paraphrase during session

We have a web application which is used to store secrets (passwords, pins etc) and share them to other system users. Currently for encryption we use AES with single encryption key, and all secrets ...
2
votes
2answers
859 views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
7
votes
1answer
4k views

Convenient Write Once Media to attach to a computer: A USB stick or device?

What is a convenient write once media to use with a Computer, preferably via the USB interface. I often see this use-case in several ways: I have a server whose logs need to be on a medium that ...
7
votes
1answer
677 views

Safe to render data directly to DOM from localStorage? XSS attack possible?

I read that localstorage is susceptible to XSS attacks. I currently store JSON Web Token (JWT) in localstorage, and I access and display data about the user through localstorage: var localstore = //...
1
vote
1answer
329 views

Brief staging area for unencrypted files

I have an integration workflow where: A server retrieves remote file via an encrypted connection. The file is unencrypted. The server runs linux (Ubuntu 14.04LTS). The file is downloaded to a ...
5
votes
2answers
599 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
15
votes
2answers
8k views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
10
votes
4answers
41k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
1
vote
1answer
212 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?