CODEWITHSUNDEEP
htmlsecuritylocal-storage
dev.e.loper
dev.e.loper

Reputation: 36054

Is it okay to store session id in localStorage?

Is it secure to store user's session id in localStorage? On w3.org site, they say

User agents must raise a SECURITY_ERR exception whenever any of the members of a Storage object originally returned by the localStorage attribute are accessed by scripts whose effective script origin is not the same as the origin of the Document of the Window object on which the localStorage attribute was accessed.

So does this mean localStorage could be used for sensitive data?

Upvotes: 20

Views: 12185

Answers (2)

jfriend00
jfriend00

Reputation: 707716

It depends upon what you mean by "is it secure"?

localStorage is about as secure as a non-path restricted cookie. From web pages, it can only be accessed by pages from the same domain. Zillions of sites store session ids in cookies which have about the same security restrictions as localStorage.

Outside of web pages, neither localStorage nor cookies are secure at all from access by other programs or even web debugging tools running on the same computer.

Upvotes: 15

user849827
user849827

Reputation:

httpOnly cookies provide a layer of XSS defence that localStorage does not provide:

  • httpOnly cookies are not accessible from [potentially malicious] JS.
  • localStorage is accessible from JS.

Session IDs should be stored in httpOnly secure cookies.

Upvotes: 32

Related Questions