Questions tagged [local-storage]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
65 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
0 votes
0 answers
19 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
user avatar
  • 123
1 vote
1 answer
169 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
user avatar
  • 113
2 votes
1 answer
79 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
user avatar
7 votes
1 answer
4k views

Logging in as another user - Security Issue

Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
user avatar
1 vote
0 answers
193 views

Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off? Or, more ...
user avatar
1 vote
0 answers
446 views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
user avatar
0 votes
1 answer
129 views

How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite. Question When physical disk destruction is ...
user avatar
  • 1,224
0 votes
1 answer
488 views

How to best store the password for Keepass for a python bot that runs in Windows?

I have a python bot that runs in Windows 10 and accesses Keepass with a password. I'm wondering what would be the correct way to store and access this Keepass password. Currently, the Keepass password ...
user avatar
  • 195
0 votes
0 answers
84 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
user avatar
  • 1
0 votes
1 answer
214 views

Is storing a short lived JWT on initial login in LocalStorage safe?

I was reading this question and still have doubts about my use case. I know it's unsafe to store a JWT in local/session storage due to XSS attacks. But what if it's for a JWT that only lasts 1 min ...
user avatar
  • 101
3 votes
1 answer
419 views

What's wrong with storing a username and password as a cookie?

I'm working on a legacy application that issues JWTs with a short expiry time. They do not have refresh token functionality implemented. So obviously while using refresh tokens would be the right ...
user avatar
4 votes
1 answer
467 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
user avatar
  • 143
0 votes
0 answers
146 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
user avatar
  • 1
2 votes
2 answers
236 views

What wrong with this system to proactively check if customers' passwords have been found in a breach?

Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
user avatar
1 vote
1 answer
412 views

How to store private keys in browsers after Apple's decision to wipe script-writeable storage?

We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple. The TLDR; ...
user avatar
  • 113
1 vote
1 answer
283 views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...
user avatar
1 vote
1 answer
789 views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
user avatar
  • 111
-3 votes
1 answer
150 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
user avatar
  • 149
0 votes
1 answer
1k views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
user avatar
  • 101
1 vote
0 answers
154 views

Does Telegram official client encrypt its local storage on iOS with app-specific passcode?

I failed to find any proofs for / against the question in the subject. My end-user question is: if I set up a long paraphrase on official Telegram client, can I be sure that history of chats (...
user avatar
3 votes
2 answers
3k views

Is LocalStorage in web browsers safe enough to store passwords?

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
user avatar
2 votes
1 answer
2k views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
user avatar
  • 165
3 votes
1 answer
126 views

What data related to a specific web page can be obtained outside the browser?

The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
user avatar
  • 33
1 vote
0 answers
785 views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
user avatar
  • 2,220
2 votes
1 answer
93 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
user avatar
3 votes
0 answers
2k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
user avatar
  • 131
9 votes
1 answer
3k views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
user avatar
  • 195
1 vote
2 answers
239 views

Why are third party cookies sent to second party websites?

When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request. This goes against my whole understanding of cookies which is that cookies are only ...
user avatar
25 votes
2 answers
24k views

Is it safe to store a JWT in sessionStorage? [duplicate]

This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage) So, ...
user avatar
56 votes
4 answers
13k views

Is the OWASP recommendation regarding localstorage still valid?

I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS. For authentication, we are using Auth0. The Auth0 documentation ...
user avatar
  • 2,436
0 votes
1 answer
3k views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
user avatar
  • 153
2 votes
1 answer
5k views

Storing Username in sessionStorage: bad idea?

I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
user avatar
  • 223
-1 votes
1 answer
154 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
user avatar
  • 139
1 vote
1 answer
3k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
user avatar
2 votes
0 answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
user avatar
  • 197
0 votes
1 answer
144 views

Store password in Chrome exclusively online

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
user avatar
  • 423
0 votes
1 answer
413 views

Can I store secrets in localStorage? Will malware have access to it?

If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?
user avatar
  • 109
2 votes
1 answer
1k views

Storing privacy sensitive data in a local application [closed]

We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
user avatar
  • 121
2 votes
1 answer
666 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
user avatar
  • 333
2 votes
1 answer
150 views

Proper way of archiving malicious files

I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (...
user avatar
  • 996
2 votes
1 answer
11k views

JWT tokens size problem

I'm developing a single-page-app that interacts with an oAuth based service. This service grants JWT tokens (refresh and access) for a lot of resources. Potentially the number of tokens can be ...
user avatar
4 votes
1 answer
7k views

How to securely store accesstoken in android

I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application. In this case, the local storage ...
user avatar
3 votes
2 answers
456 views

Checking a locally stored string for tamper

I'm working on a multiplayer game using WebSockets. I've decided all user data will be stored on the client, eliminating the need for authentication using passwords etc. LocalStorage 'save' -> '{"...
user avatar
3 votes
1 answer
6k views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
user avatar
1 vote
1 answer
335 views

Can LastPass local password store (on a Android device) be brute forced in a usual way?

I' trying to figure out how secure LastPass is if you have it on your Android device and it gets stolen. If I'm not mistaken there has to be a password vault stored somewhere locally on the device. ...
user avatar
  • 113
0 votes
0 answers
528 views

Is keeping business data in browser database websql secure?

Knowing that Server always validates the data before saving it. Browser app is generating the data based on user input and some business logic and is storing it locally. Browser app then synchronize ...
user avatar
1 vote
0 answers
168 views

Storing user private key paraphrase during session

We have a web application which is used to store secrets (passwords, pins etc) and share them to other system users. Currently for encryption we use AES with single encryption key, and all secrets ...
user avatar
  • 200
2 votes
2 answers
1k views

Can a BIOS or UEFI infection transfer to other storage drives without the OS presence?

I am already aware that a BIOS or UEFI malware "activate" only in the OS environment. Is it possible though that a spread mechanism be activated without the presence of the OS, so that it would infect ...
user avatar
  • 415
11 votes
1 answer
6k views

Convenient Write Once Media to attach to a computer: A USB stick or device?

What is a convenient write once media to use with a Computer, preferably via the USB interface. I often see this use-case in several ways: I have a server whose logs need to be on a medium that ...
user avatar
  • 1,013