new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

storage_apis/client_side_databases

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Web SQL Database deprecated and removed

Web SQL Database was deprecated by the W3C in 2010 and is removed from all major browsers. Chromium dropped support in version 119 (October 2023) and Safari/Firefox never shipped it for third-party origins. Do not use Web SQL. If an SQL interface in the browser is needed, prefer running an embedded engine such as the official SQLite WebAssembly build (sqlite-wasm), backed by IndexedDB or the Origin Private File System (OPFS) for persistence.

IndexedDB current standard for client-side storage

The current standard for client-side structured storage is IndexedDB, a transactional key-value store that has been a W3C Recommendation since 2015 and is supported in all evergreen browsers.

IndexedDB no unencrypted session tokens or secrets

Do not store session tokens, credentials, or other secrets in IndexedDB unless they are encrypted with a key that is not itself recoverable from the browser, such as a key derived from a user-supplied passphrase that is never persisted, or wrapped by a non-extractable Web Crypto CryptoKey. Do not assume client-side storage provides confidentiality because a user with read access to the browser profile directory on disk can read or modify the stored data.

IndexedDB treat as untrusted on read

A single Cross-Site Scripting vulnerability can read or write any data in IndexedDB. Treat its contents as untrusted input on read. Apply the same input validation and output encoding rules to data coming from IndexedDB as you would to data coming from the network.

Give your agent this brain