new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

storage_apis/local_storage

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

LocalStorage shared across origin without path restriction

There is no way to restrict the visibility of an object to a specific path like with the path attribute of HTTP Cookies. Every object is shared within an origin and protected with the Same Origin Policy. Avoid hosting multiple applications on the same origin; all would share the same localStorage object. Use different subdomains instead.

LocalStorage and sessionStorage no sensitive data

Do not store sensitive information in local storage. Any authentication an application requires can be bypassed by a user with local privileges to the machine. A single Cross Site Scripting vulnerability can be used to steal all data in these objects or load malicious data into them. Do not store session identifiers in local storage as data is always accessible by JavaScript; cookies with the httpOnly flag mitigate this risk.

sessionStorage vs localStorage

Use the object sessionStorage instead of localStorage if persistent storage is not needed. sessionStorage object is available only to that window/tab until the window is closed.

Give your agent this brain