News for hackers. Stuff that matters.

A comment on Inter-window messaging using localStorage.

Re:Inter-window messaging using localStorage by btipling on Saturday March 09, 2013 @01:41PM (#5349176)
localStorage doesn't clear when the browser exits so it's a security issue in some cases. Look at sessionStorage instead in that case.
[ Parent | on HN ]
Re:Inter-window messaging using localStorage by Benferhat on Saturday March 09, 2013 @01:52PM (#5349212)
sessionStorage won't work across tabs. You have to encrypt sensitive data; I use securecookie [0].

[0] http://godoc.org/github.com/gorilla/securecookie (Go)

[ Parent | on HN ]
Re:Inter-window messaging using localStorage by angersock on Saturday March 09, 2013 @02:17PM (#5349292)
Hmm....

Could you use sessionStorage to hold a temporary key for decrypting whatever is localStorage?

[ Parent | on HN ]
Re:Inter-window messaging using localStorage by bensummers on Saturday March 09, 2013 @02:01PM (#5349239)
Yes, there are potential security issues with this, but as with anything in the browser you need to think through where your secrets are held. A similar issue comes with setting an expiry time of a few hours on a resource to let the browser cache it, so it's something web developers have been battling against for years.
[ Parent | on HN ]