I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
Asked
Active
Viewed 268 times
1
-
Is there any reason you want to use Web Storage instead of cookies for this purpose? – rink.attendant.6 Oct 24 '14 at 19:36
-
I didn't mean web storage. I meant local storage, the are other than cookies. – Anandu M Das Oct 27 '14 at 08:02
-
Local storage IS Web Storage. Same with session storage, but not session cookies or any other type of cookies. – rink.attendant.6 Oct 27 '14 at 08:05
-
I can't believe that local storage is web storage, since I could see my local storage data in an sqlite file under any browser in my local machine how can it be web storage? – Anandu M Das Oct 27 '14 at 08:13
-
1Local storage is stored locally but it is called Web Storage because it is a web technology... see http://dev.w3.org/html5/webstorage/ – rink.attendant.6 Oct 27 '14 at 08:15
1 Answers
3
I assume you mean a server-side identifier, like PHPSESSID or ASPSESSIONID.
Client accessibility comes to mind. With cookies, they can be marked as HttpOnly, thus making them unreadable from JavaScript. This mitigates an attacker that exploits XSS from stealing your session cookie because a complying browser will refuse to give the cookie to the malicious script.
Local storage on the other hand, has no such protection that I am aware of. Local storage is never sent to the server by the browser (where cookies are), so it would be useless to have local storage that cannot be read client side.
vcsjones
- 215
- 2
- 9
-
It is possible to send local storage to server. Usually web applications like shopping sites stores the cart details temporarily in local and send to the server at the end of browsing session. – Anandu M Das Oct 27 '14 at 08:04
-
@AnanduMDas the only way to send it to the server is to have client script send it - which then an attacker can do with XSS, too. You could use CSP to prevent that, though some browsers, like IE, have weak support for CSP. – vcsjones Oct 27 '14 at 11:07