Do modern browsers encrypt or otherwise protect IndexedDB storage?

Question

My team is considering using IndexedDB to cache data across user sessions. This data can be large enough that it would be a real performance boost to be able to keep it around in the browser for later use instead of having to download it every time the user needs it.

I am concerned about security problems with IndexedDB. The data in question isn't super sensitive, but there is a reason we require a user/pass to get to it. I worry that this data might be accessible if a user's laptop were stolen. Are these files sitting around unencrypted on the file system?

Answer 1

You can encrypt before storing into indexeddb. That is how I do in my open source library, http://dev.yathit.com/ydn-db/doc/usage/encryption.html

One thing to note, encrypted database cannot be query. You can only retrieve with known primary key.

You still need to pass encryption key from the server after user login.

Answer 2

Unless your users are using full disk encryption on their laptops, those files are sitting there unencrypted. You could consider encrypting the data you store using some javascript crypto with a key derived from the user's password.