Menu
I'm using client-side JavaScript to store some variables using Web Storage, more specifically, the sessionStorage.
But I'm not sure whether a user can simply modify the value of such variables in any way? If so, please provide an example of how this could happen.
203
Things like Database Data such as User Rows should not be stored in the session and you should create a separate cache mechanism to do this for you. Save this answer.
The data is not stored and no existing data is overwritten. A QUOTA_EXCEEDED_ERR exception is thrown.
The difference between sessionStorage and localStorage is that localStorage data does not expire, whereas sessionStorage data is cleared when the page session ends. A unique page session gets created once a document is loaded in a browser tab. Page sessions are valid for only one tab at a time.
Yes, users can always modify the values of their own storage. I can think of three ways right off the bat:
What's important is that you don't trust client storage. If you're going to store session information on the client, then you need some way for your server-side code to verify that the information hasn't been tampered with. There are other reasons you may not want to store this information on the client side (privacy, for example), but assuming you've thought through those, you still need to make sure you either trust the client's data or that you make sure trust isn't necessary.
138
Not exactly sure in your case, but as a rule sessions should always be handled server side and not client side. The one of the main points of sessions is to remove that data from the client side altogether for security reasons
21
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
