Skip to main content

Questions tagged [local-storage]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
2k views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
2 votes
1 answer
624 views

Apple Mail versus GMail app content security

I am trying to determine if there is a benefit to using the GMail app over the built in iOS one when it comes to security. I know that both store data locally on the phone, but the question is whether ...
0 votes
2 answers
2k views

Storing sensitive data in Local Storage with encryption?

I have a notes app that's offline-first and syncs with remote database when online. Currently, when a user creates a note, I'm encrypting it with AES. I ask the user to enter their decryption ...
0 votes
1 answer
98 views

how to send cookies or token in local storage to a remote server using reflected XSS

I have an XSS vulnerability identified by <script>alert(1);</script> in the url. So when I put it in the url it gets executed (ex: www.example.com/admin/<script>alert(1);</script&...
0 votes
1 answer
90 views

Password-based encryption: keeping the user logged in without entering password again

Context I have a system where some of user's data is encrypted via AES. Each user has their own key K. When the user creates an account, the K is generated and encrypted with a key derived from ...
2 votes
0 answers
103 views

Secure API token handling in Windows app: the token is needed to authenticate the requests to a backend server

I'm currently working on a UWP app that involves validating redemption codes against a Cloudflare KV storage backend. That's all the backend server is for. I want the app to check the redemption code ...
1 vote
1 answer
10k views

Where to store JWT refresh tokens

Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
5 votes
2 answers
2k views

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

In the context of a web application... should sensitive tokens, such as those used for sessions, authentication and/or authorization, be stored in localStorage or an HTTPOnly cookie; or are they both ...
0 votes
0 answers
167 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
0 votes
3 answers
403 views

Do browser vendors have access to LocalStorage/cookies?

Question is pretty much in the title. We have a customer that is very concerned with privacy, and we're making a solution that will rely on data being stored in LocalStorage, so we just need to verify ...
0 votes
0 answers
5k views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
19 votes
3 answers
132k views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
0 votes
0 answers
20 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
1 vote
0 answers
801 views

Does Safari's "Prevent cross-site tracking" option ACTUALLY prevent determined efforts at cross-site tracking? (By, e.g. Facebook)

In other words: Does Safari's "Prevent cross-site tracking" option effectively prevent cross-site tracking? (Is it for purpose?) I though it would work; are my expectations off? Or, more ...
1 vote
1 answer
1k views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
3 votes
1 answer
528 views

Cookies VS localStorage (JavaScript Security)

I know that HTTP requests made by the site get the browser's localStorage for a site, and document.cookie is encrypted for HTTPs websites, but I'm still wondering the risk of storing sensitive ...
1 vote
1 answer
2k views

How to best store the password for Keepass for a python bot that runs in Windows?

I have a python bot that runs in Windows 10 and accesses Keepass with a password. I'm wondering what would be the correct way to store and access this Keepass password. Currently, the Keepass password ...
7 votes
1 answer
4k views

Logging in as another user - Security Issue

Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
2 votes
0 answers
1k views

Progressive web app, Access token storage

I'm currently working on an existing PWA (Progressive web app) build in VUEJS. Currently i'm using Auth0 for user authentication and it works fine. But it seems a bit overkill and client finds it very ...
0 votes
1 answer
405 views

How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite. Question When physical disk destruction is ...
15 votes
3 answers
10k views

Cordova/Phonegap: RefreshToken in localstorage

I am (partly) following a tutorial to develop a cordova app, based on angularJS. The author stores the refresh token in local storage, which was said to be very bad practice in one of the comments on ...
0 votes
0 answers
126 views

Should you even bother trying to hide authentication from XSS?

I read a comment on here that goes something like "trying to hide user authentication from an XSS attack is like reinforcing your fridge against a nuclear bomb; at that point, you've got much ...
0 votes
1 answer
341 views

Is storing a short lived JWT on initial login in LocalStorage safe?

I was reading this question and still have doubts about my use case. I know it's unsafe to store a JWT in local/session storage due to XSS attacks. But what if it's for a JWT that only lasts 1 min ...
3 votes
1 answer
993 views

What's wrong with storing a username and password as a cookie?

I'm working on a legacy application that issues JWTs with a short expiry time. They do not have refresh token functionality implemented. So obviously while using refresh tokens would be the right ...
9 votes
1 answer
904 views

Are Javascript closures a useful technique to limit exposing data to XSS?

I'm wondering if using Javascript closures is a useful technique to limit exposing data to XSS? I realize it wouldn't prevent an attack, but would it reliably make an attack more difficult to execute, ...
0 votes
0 answers
233 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
2 votes
2 answers
284 views

What wrong with this system to proactively check if customers' passwords have been found in a breach?

Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
1 vote
1 answer
641 views

How to store private keys in browsers after Apple's decision to wipe script-writeable storage?

We have a web application that puts a private key in LocalStorage, which enables users to sign off certain messages. It's been working fine until today we saw this announcement from Apple. The TLDR; ...
2 votes
1 answer
1k views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...
1 vote
1 answer
1k views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
-3 votes
1 answer
202 views

What led to the prominence of storing JWTs in localstorage?

Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
2 votes
2 answers
4k views

Is LocalStorage in web browsers safe enough to store passwords?

I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
2 votes
1 answer
2k views

How is security risk of storing authentication token in localStorage compared with cookies?

I've read that it's a bad idea to save Single Page App's encrypted authentication token in browser's localStorage because this makes your app vulnerable to XSS attack, and when the token is stolen, ...
3 votes
1 answer
164 views

What data related to a specific web page can be obtained outside the browser?

The browser has several built-in storages, such as local storage or indexedDB. Does it make sense to store sensitive data in them if there is a risk that some malware can access the browser's data ...
2 votes
1 answer
125 views

Data extraction, temporary storage and audit log - Advice needed

At work, we are planning to take down a database for 24 hours. We are not going down the track of creating a "Hot standby", the DB will be completely offline throughout. During the downtime, we would ...
3 votes
0 answers
3k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
10 votes
1 answer
4k views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
1 vote
2 answers
344 views

Why are third party cookies sent to second party websites?

When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request. This goes against my whole understanding of cookies which is that cookies are only ...
59 votes
4 answers
16k views

Is the OWASP recommendation regarding localstorage still valid?

I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS. For authentication, we are using Auth0. The Auth0 documentation ...
27 votes
2 answers
27k views

Is it safe to store a JWT in sessionStorage? [duplicate]

This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage) So, ...
2 votes
1 answer
695 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
0 votes
1 answer
3k views

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

If I were to implement a common OpenID Connection pattern on a SPA, I might have the following relationship: Auth server <-----------> Client (browser) <-----------> App API server The ...
2 votes
1 answer
7k views

Storing Username in sessionStorage: bad idea?

I am working on React-Django application that uses JWT for authentication. The user signs in with their username and password, the server validates and responds with JWT and username, and (currently) ...
-1 votes
1 answer
180 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
1 vote
1 answer
4k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
3 votes
0 answers
1k views

Is it a good practice to combine cookies and local storage to protect against XSS and CSRF?

We know that cookies with httpOnly and secure flag are immune to XSS and vulnerable to CSRF attacks. And at the same time we know that local storage is vulnerable to XSS, but can protect against CSRF. ...
0 votes
1 answer
174 views

Store password in Chrome exclusively online

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
0 votes
1 answer
491 views

Can I store secrets in localStorage? Will malware have access to it?

If a Windows user downloaded and ran a pirated computer game that contained malware and is granted administrative privileges, will it have access to localStorage or browser cookies?
2 votes
1 answer
1k views

Storing privacy sensitive data in a local application [closed]

We have multiple desktop applications that are being used by clients on unconnected desktop computers. The application instances are being used by multiple users secured by username and password. The ...
2 votes
1 answer
190 views

Proper way of archiving malicious files

I have to archive (and in some cases analyse) malicious files that were able to get in our company. What precautions should one take for handling these files? Given that the files won´t be executed (...