53 votes
Accepted

Is the OWASP recommendation regarding localstorage still valid?

Personally I see no issue with using local storage as long as you are happy with the user not having to re-authenticate between sessions. The linked answer provides the following argument against this....
Hector's user avatar
  • 10.9k
30 votes
Accepted

Is it safe to store a JWT in sessionStorage?

How bizarre! I asked basically the same question about a month ago. In the end, we decided that using localstorage for the JWT token was ok, as long as we also did the following on the HTTP level: ...
JMK's user avatar
  • 2,506
26 votes

Logging in as another user - Security Issue

It's a bug in their web site, and such bugs are fairly common. They're usually something like the result of an incorrectly copied session cookie, a corrupted cache, or other programming bug. In order,...
John Deters's user avatar
  • 34.2k
18 votes

Is the OWASP recommendation regarding localstorage still valid?

The reason local storage is considered unsafe is because any JavaScript that executes in the context of the page can access this. This opens you up to session hijacking via reflective XSS and stored ...
McMatty's user avatar
  • 3,260
6 votes

Is it safe to store a JWT in sessionStorage?

Well it depends. If you have an XSS vulnerability within your application an attacker can extract and use the JWT from your local storage. A method I've used and I think Auth0 indicate is to use the ...
McMatty's user avatar
  • 3,260
6 votes
Accepted

How secure is HTML5 web storage (sessionStorage and localStorage)?

The user can modify and delete anything stored in their browser. Any malware installed in the user's system with the user's privilege can also do so. The system administrator can also modify and ...
Lie Ryan's user avatar
  • 31.4k
6 votes
Accepted

How to securely store accesstoken in android

Can this be achieved with Keystore? I don't think that fits your use case. Keystore is designed to store cryptographic keys that will be used for encryption, decryption and signing. The idea is that ...
Out of Band's user avatar
  • 9,273
6 votes
Accepted

Authentication with JWT

Let's begin with the easy part: Option #2 is a non-options. It comes with no CSRF-protection, so it is inherently vulnerable. Actually, option #3 is pretty much option #2 with CSRF-protection on top. ...
Anders's user avatar
  • 65.6k
6 votes
Accepted

Are Javascript closures a useful technique to limit exposing data to XSS?

The goal here is to keep the token secret, even if an attacker exploits an XSS vulnerability - sort or like emulating the HTTP-only flag for cookies, in other words. I guess the closure would be a ...
Anders's user avatar
  • 65.6k
5 votes
Accepted

How is security risk of storing authentication token in localStorage compared with cookies?

A cookie marked httpOnly, as the name implies, cannot be accessed from javascript. So a 'conventional' web application using cookies is not vulnerable to naive XSS attacks if that flag is set (...
Affe's user avatar
  • 351
5 votes
Accepted

Why are third party cookies sent to second party websites?

Cookies set by scripts are always associated with the webpage's domain, not the domain that the script came from. (If this weren't the case, then it would often be easy to include a script from a ...
Macil's user avatar
  • 1,492
4 votes
Accepted

Checking a locally stored string for tamper

What you want is something that ensures integrity of your data. The most common solution for this is to use an HMAC, that is a keyed digest. NodeJS has an API that calculates HMACs. Compared to a "...
user2313067's user avatar
4 votes

Should sensitive tokens be stored in localStorage or an HTTPOnly cookie?

Your description is correct. The use of cookies has the preference here in terms of security. However, the HttpOnly flag is not the only thing that is required for optimal security. Set the SameSite ...
Wouter's user avatar
  • 631
4 votes
Accepted

What's wrong with storing a username and password as a cookie?

The main problems are: The username and the password are sent again on every request, making it easier to steal the actual credentials instead of hijacking the session. A compromised session can ...
Esa Jokinen's user avatar
4 votes
Accepted

Cookies VS localStorage (JavaScript Security)

There are several few confusions here, which I'll try to clear up for you. HTTP/HTTPS requests don't get access to storage at all. However, scripts running on a page get access to storage for the ...
CBHacking's user avatar
  • 48.4k
3 votes

Is the OWASP recommendation regarding localstorage still valid?

Following the advices from the auth0 blog you can counter security concerns by keeping a low token expiration value and more importantly you can encrypt the token. An alternative approach would be ...
Stefan's user avatar
  • 131
3 votes
Accepted

Can LastPass local password store (on a Android device) be brute forced in a usual way?

Making brute-force attack the only possible option is a desired feature of a security system. This "only" would mean there are no weaknesses in the algorithm or implementation and the system could be ...
techraf's user avatar
  • 9,149
3 votes
Accepted

Cookie vs HTML5 localStorage

Both cookies and localstorage are accessed via JavaScript APIs. When the attacker can inject JavaScript into the target's html document, they can read and write them equally. A comment mentions http-...
Philipp's user avatar
  • 49.4k
3 votes
Accepted

Proper way of archiving malicious files

Not using a VM will leave you totally dependent on the static analysis programs and any other program (hex editor, text editors and so on) you use. This is dangerous. In my opinion, too dangerous. ...
MiaoHatola's user avatar
  • 2,304
2 votes
Accepted

JWT tokens size problem

First thought is that it does seem to be quite a lot of tokens and it does beg the question if it's indeed a requirement for the authorization server to issue so many specific tokens or if less tokens ...
João Angelo's user avatar
2 votes

Can I store secrets in localStorage? Will malware have access to it?

On PC's the browsers local storage and cookie storage is not specifically protected. This means that any process running with the same or higher privileges as the browser will be able to read and ...
Steffen Ullrich's user avatar
2 votes

Is the OWASP recommendation regarding localstorage still valid?

I'm not 100% into security. I read something else out of it. The problem with "sensitive token information" is the same problem, be it a cookie or localStorage. But you can save far more data into ...
Fabian Blechschmidt's user avatar
2 votes

Is LocalStorage in web browsers safe enough to store passwords?

Terrible idea. Don't store the password in clear text between pages, not on the client and not on the server. Redesign your page flow (for instance by only entering the user name on the first login ...
Brezelbub's user avatar
  • 121
2 votes
Accepted

What data related to a specific web page can be obtained outside the browser?

You should avoid consider storing sensitive data at all. Conceptually, if a system is compromised, it doesn't matter where you store the data; any code that can examine's the browser's memory doesn't ...
phyrfox's user avatar
  • 5,734
2 votes

How to best prevent data recovery on a disk drive without physically destroying it?

Yes variants of this question constantly recur, nevertheless I'll try to do a quick and dirty answer before this gets closed. A single pass over write of the raw drive with anything, zeros, random, ...
user10216038's user avatar
  • 8,113
2 votes

Where to store JWT refresh tokens

Your question isn't clear whether you mean in the client (the thing that first receives and then uses the refresh token) or the server (where the token is generated and then consumed), nor as to ...
CBHacking's user avatar
  • 48.4k
2 votes

Password-based encryption: keeping the user logged in without entering password again

You should use sessionStorage, not localStorage. Data in localStorage is persisted on disk as plaintext, whereas sessionStorage gets automatically cleared when the tab or browser is closed (which ...
Ja1024's user avatar
  • 5,907
1 vote

Is encrypting localStorage data more secure?

An attacker has full control over the client, and therefore has complete access to the encryption keys and methods. In short, this cannot actually protect anything from an attacker. Normally client-...
Conor Mancone's user avatar
1 vote

What led to the prominence of storing JWTs in localstorage?

I have also noticed an uprising of storing JWT's in LocalStorage, but thankfully recently some developers are making articles on why not to do that. This is a pretty broad topic and in no way I am ...
Raimonds Liepiņš's user avatar
1 vote

Is LocalStorage in web browsers safe enough to store passwords?

You shouldn't store the password in LocalStorage for the following reasons: LocalStorage contents stay there forever if you don't delete it. If a user clicks the login button and then decides not to ...
nebulak's user avatar
  • 390

Only top scored, non community-wiki answers of a minimum length are eligible