HTML5 Web DB Security

security html offlineapps
user317077 picture user317077 · Apr 15, 2010 · Viewed 21.5k times · Source

I'm looking into an offline web app solution using HTML5. The functionality is everything I need BUT the data stored can be directly queried right in the browser and therefore completely unsecure!

Is there anyway to encrypt/hide so that the data is secure?

Thanks, D.

Answer

Sripathi Krishnan picture Sripathi Krishnan · Apr 15, 2010

There are two concerns to local storage in HTML5 -

  1. One website reading offline data that another website has stored in a users browser
  2. An end user querying your websites offline data directly

For 1, browsers enforce the same-domain restrictions to localStorage (or the sqllite database support that safari has), so other websites won't have access to the data that you store. However, do remember that if your site has XSS vulnerabilities, it would be possible to steal the data.

For 2, you can't prevent it. Its just like a cookie - the user can chose to view/delete/modify it.

Encryption of data is possible (see http://farfarfar.com/scripts/encrypt/), but pointless. You cannot have a single, global key/password - because an attacker can easily figure the key from javascript code. Using a user-entered password to encrypt/decrypt is possible, but client-side encryption libraries aren't mature or tested well enough. There are likely tons of way to break it.

So, for now atleast, don't store sensitive data in localStorage.

Related questions

How to allow http content within an iframe on a https site

I load some HTML into an iframe but when a file referenced is using http, not https, I get the following error: [blocked] The page at {current_pagename} ran insecure content from {referenced_filename} Is there any way to turn …

Read More
How does Content Security Policy (CSP) work?

I'm getting a bunch of errors in the developer console: Refused to evaluate a string Refused to execute inline script because it violates the following Content Security Policy directive Refused to load the script Refused to load the stylesheet What's …

Read More
Is either GET or POST more secure than the other?

When comparing an HTTP GET to an HTTP POST, what are the differences from a security perspective? Is one of the choices inherently more secure than the other? If so, why? I realize that POST doesn't expose information on the …

Read More