Client-Side Storage and Privacy

This lesson is about a question every modern web application answers, usually without thinking about it: what data does this application keep in the user's browser, and is that the right place to keep it?

The browser exposes four primary places an application can persist data on the client side: localStorage, sessionStorage, IndexedDB, and cookies. Each tier has its own lifetime, its own scope, and its own access model. The differences matter. A value in localStorage is readable by any JavaScript on the same origin - including a third-party analytics script, a malicious script injected through cross-site scripting, and any browser extension the user has installed. A value in an HttpOnly cookie is not readable by JavaScript at all, regardless of how it got there. The choice of where to put a value is not just a performance choice; it is a security and privacy choice.

In this lesson you will:

Use Storage Inspector to walk through the simulated localStorage, sessionStorage, IndexedDB, and cookie surfaces.
Identify the authentication token in localStorage and articulate the threat model that makes that choice risky, mapping to the same XSS attack surface introduced in the Reflected and Persistent XSS lesson and the credential discussion in the Session Management and JWT Security lesson.
Inspect the basket contents, the email address, the language preference, and the other personal state NovaCart caches in the browser, and notice how much of it survives a logout.
Articulate the principle of data minimization: do not store on the client what the client does not need, do not store in plaintext what an attacker should not read, do not retain after logout what the user has asked to forget.
Reason about the durable architecture for credential storage (HttpOnly, Secure, SameSite cookies) and contrast it with the localStorage pattern NovaCart uses.

Estimated time: twenty to thirty minutes.

Background: the Reflected and Persistent XSS lesson and the Session Management and JWT Security lesson are useful because this lesson explains why localStorage is the wrong place for a credential. No separate browser-storage tool is required here.

When you are ready, send the Continue signal.

In this lesson you will:

Use Storage Inspector to walk through the simulated localStorage, sessionStorage, IndexedDB, and cookie surfaces.
Identify the authentication token in localStorage and articulate the threat model that makes that choice risky, mapping to the same XSS attack surface introduced in the Reflected and Persistent XSS lesson and the credential discussion in the Session Management and JWT Security lesson.
Inspect the basket contents, the email address, the language preference, and the other personal state NovaCart caches in the browser, and notice how much of it survives a logout.
Articulate the principle of data minimization: do not store on the client what the client does not need, do not store in plaintext what an attacker should not read, do not retain after logout what the user has asked to forget.
Reason about the durable architecture for credential storage (HttpOnly, Secure, SameSite cookies) and contrast it with the localStorage pattern NovaCart uses.

Estimated time: twenty to thirty minutes.

When you are ready, send the Continue signal.