Chrome local storage and security

Question

I'm using a local storage value to check whether a user is logged into my Chrome extension.

• Can users edit their own local storage values? If I were to use their user ID in my database, I wouldn't want them to be able to log in as something else just by editing that ID, e.g. incrementing by 1.
• Should it be something that the user shouldn't be able to see? I also considered using their salt, but I might not want to reveal that to the user.

Answer 1

You are right to be concerned. Generally, client-side code and data can't be trusted because it's in the hands of the attacker. The question is identical to the problem faced with web cookies: a browser can report anything at all as cookie data, so the server can't trust it. You have two general options to get around this problem. One is an HMAC, and the other is public-key signatures. Both require a server, but only the latter can verify without a server.

An HMAC requires that the secret remain inaccessible to the attacker at all times, but it's required for both generation and authentication (that is, that it stay on the server and be verified on the server). You haven't given us enough information to tell whether your extension is appropriate for this use case. Most industrial-strength cookies these days use some variant of an HMAC.

Public-key signatures require that the signing be done in secret (that is, on the server), but after that point the client can verify it without talking to the server.

The big problem that you'll face with any of these schemes is that two people can collude to copy one person's credentials to another machine, or one person can steal another person's credentials. Again, with client-side code you can't really trust anything. But either of these schemes prove that an attacker didn't make up login credentials entirely on his or her own.

Think of this problem as a web cookie problem. However you solve that problem, you can also apply it to chrome.storage.