Email or username:

Password:

Forgot your password?
Simon's posts Post Back to profile
Top-level
Marijke Luttekes

@simon I don't know the fine details, but it is (or was earlier this year) to access localStorage data from other domains:

trycatchdebug.net/news/1157081

25 October at 22:40 | Wall-to-wall | Open on fosstodon.org
3 comments
Simon Willison

@mahryekuh it looks so me like that's only a problem if you have an XSS hole allowing attackers to execute malicious JavaScript, in which case localstorage leaks are the least of your problems!

25 October at 22:42 | Open on fedi.simonwillison.net
Phil Johnston

@simon @mahryekuh localStorage can affect someone who is using a public computer, like at a library. The next person to use the machine will have their form data available.

25 October at 23:57 | Open on mstdn.social
Simon Willison

@johnstonphilip @mahryekuh I guess you could encrypt it with a public key in the JavaScript and have a private key server-side that is only available when the user is signed into their account

26 October at 2:07 | Open on fedi.simonwillison.net
Go Up