CODEWITHSUNDEEP
javascripthtmlsecuritylocal-storagesingle-page-application
kdb
kdb

Reputation: 4426

Per-page localStorage?

In HTML5, is it possible to create a localstorage that is accessible only to a single webpage?

I am currently experimenting with possibilities of writing self-contained single-page applications, and whether it is possible for users to host them themselves, e.g. on their Dropbox (which has some basic webhosting capabilities for public files) or by running a minimal webserver on localhost.

A user may then start such HTML Applications from various sources in his local server / Dropbox, or be asked to open one from another users Dropbox.

Since all these pages would be served from the same origin (currently https://dl.dropboxusercontent.com), they would all share a single localStorage, which may both interfere with the functionality if names clash, and leak data; E.g. such a page may want to store the authentication token for accessing the users Dropbox account in localStorage, but then any other such "App" would be able to steal the token.

I have to say here, that I am new to HTML5, and may very well be stretching the intended scope of usage here, as I keep running into limitations due to basic websecurity concepts like the same-origin policy – especially when opening a HTML file from a local drive through a file:// uri.

The core intent is allowing users to host their own custom apps in a manner that works across their mobile and desktop devices, by utilizing their existing webservice subscriptions for both hosting and data synchronization rather than moving their data to yet another service.

Upvotes: 2

Views: 1142

Answers (2)

magne4000
magne4000

Reputation: 149

As stated here, localStorage is scoped by protocol, domain and port, nothing else.

And with this, even by prefixing each localStorage key by a unique page token (i.e. localStorage.set('page1.' + key)), it wouldn't avoid another page from getting those info, so no simple way to avoid information leak.

Upvotes: 8

ysurilov
ysurilov

Reputation: 300

You can use unique page identifier (or even url) as a key for encryption of stored data. In theory.

Upvotes: 0

Related Questions