Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can Session storage / local storage be disabled and Cookies enabled?

Tags:

For most modern browsers, is it possible to have session or local storage disabled while cookies are enabled? Or does the disabling of cookies also, automatically, disable the use of session / local storage?

like image 653
Randy Minder Avatar asked Oct 24 '14 15:10

Randy Minder


People also ask

Does disabling cookies disable local storage?

If you disable the cookie , then local storage will not work.

Can localStorage be disabled?

There is a command-line option --disable-localstorage which works but disables localstorage for extensions.

Are cookies stored in session storage?

Cookies and Sessions are used to store information. Cookies are only stored on the client-side machine, while sessions get stored on the client as well as the server. Read through this article to find out more about cookies and sessions and how they are different from each other.

What is the difference between local storage and cookies when using local storage?

Local storage can store up to 5mb offline data, whereas session can also store up to 5 mb data. But cookies can store only 4kb data in text format. LOCAl and Session storage data in JSON format, thus easy to parse. But cookies data is in string format.


2 Answers

Technically speaking, cookies and the Web Storage API are different things, but a common user probably does not know the difference, nor need to. A common user has, however, heard about security concerns with cookies. He may also have heard advice to regularly clear cookies or disable them altogether. And so, a common user expects a function that says "Disable Cookies", but actually means "Don't let websites persist data on my computer".

I believe that is why most browsers continue to provide the familiar function of disabling "Cookies", but of course do more than that under the hood in order to fulfill what they think is the actual user intent.

For now, the behaviour is browser-dependent. Disabling cookies on each of these browsers disable the following:

  • Chrome: cookies, localStorage, sessionStorage, IndexedDB
  • Firefox: cookies, localStorage, sessionStorage
  • IE: cookies only

I do think that for the sake of precision and flexibility, browser vendors should tweak their implementation to have a basic option "Don't let websites store data on this computer" which disables cookies and all persistent storage mechanisms, as well as "Advanced Settings" functionality to individually disable various storage mechanisms.

like image 171
light Avatar answered Oct 10 '22 13:10

light


All I've been able to find is § 6.1 of the W3C Web Storage Specification:

Treating persistent storage as cookies

If users attempt to protect their privacy by clearing cookies without also clearing data stored in the local storage area, sites can defeat those attempts by using the two features as redundant backup for each other. User agents should present the interfaces for clearing these in a way that helps users to understand this possibility and enables them to delete data in all persistent storage features simultaneously.

Browsers "should" enable simultaneous deletion, but there's no recommendation on separate toggles for local storage and cookies.

That said, in IE 11, I'm able to disable DOM storage but enable cookies. Conversely, disabling cookies has no effect on DOM storage. In FF & Chrome latest, disabling cookies seems to also disable DOM storage.

like image 34
bishop Avatar answered Oct 10 '22 13:10

bishop