News for hackers. Stuff that matters.
Re:Google Chrome to remove detailed cookie and site data con... by Thorrez on Saturday September 04, 2021 @02:28AM (#28412616)
Discord does this. Try to find the login cookie.

When discord loads, it copies it out of localstorage into a js var and deletes the localstorage. So if you examine localstorage it will be empty. On page unload it copies it back into localstorage. So if you want to see the value, you have to make sure no discord tabs are open in your browser.

I believe one reason for this is to prevent self-xss. It's hard for a malicious person to write a snippet of js to steal the login cookie now that it's no longer in localstorage. Another reason might be to prevent bots. It's hard for someone to automate a discord account if there's no way to get the account's login cookie.

Re:Google Chrome to remove detailed cookie and site data con... by xg15 on Saturday September 04, 2021 @02:37AM (#28412659)
Wouldn't this cause problems with multiple tabs/windows?

Like, if I have one Discord tab open (so localstorage is cleared) and I open a second one in parallel, will I be logged out in the second one?

Re:Google Chrome to remove detailed cookie and site data con... by Thorrez on Saturday September 04, 2021 @02:55AM (#28412751)
I didn't look into it too deeply. Maybe if there are multiple windows they can communicate with each other in some way.
Re:Google Chrome to remove detailed cookie and site data con... by brabel on Saturday September 04, 2021 @03:41AM (#28412970)
"in some way" --> probably postMessage to send the variable to the new tab.
Re:Google Chrome to remove detailed cookie and site data con... by toomanybeersies on Sunday September 05, 2021 @04:14AM (#28422446)
Service workers would be the solution to that problem, wouldn't they?