Can Session storage / local storage be disabled and Cookies enabled?
For most modern browsers, is it possible to have session or local storage disabled while cookies are enabled? Or does the disabling of cookies also, automatically, disable the use of session / local storage?
Answer
Technically speaking, cookies and the Web Storage API are different things, but a common user probably does not know the difference, nor need to. A common user has, however, heard about security concerns with cookies. He may also have heard advice to regularly clear cookies or disable them altogether. And so, a common user expects a function that says "Disable Cookies", but actually means "Don't let websites persist data on my computer".
I believe that is why most browsers continue to provide the familiar function of disabling "Cookies", but of course do more than that under the hood in order to fulfill what they think is the actual user intent.
For now, the behaviour is browser-dependent. Disabling cookies on each of these browsers disable the following:
- Chrome: cookies, localStorage, sessionStorage, IndexedDB
- Firefox: cookies, localStorage, sessionStorage
- IE: cookies only
I do think that for the sake of precision and flexibility, browser vendors should tweak their implementation to have a basic option "Don't let websites store data on this computer" which disables cookies and all persistent storage mechanisms, as well as "Advanced Settings" functionality to individually disable various storage mechanisms.