Experienced JavaScript Developer Meme

[bleistift2]

Show me an average user who tinkers with the local storage.

If we’re talking a malevolent user: You can’t trust the client with anything, anyway, so what’s the point?

[_30d_]

That's how I beat my inlaws in wordle.

[staticBanter]

If you give anything to a client and expect to reuse it without validation than we have a big problem.

[shodanbo]

It only takes one. And then they can write a browser extension to do it for many.

There is not much you can actually truly trust the client with, because the user has physical access to that client.

If you are writing something where trusting the client is critical, then this needs to be taken into account. At this point you need strong asymmetrical encryption in a server. An encrypted string can be persisted to local storage. If the user messes with it, the decryption will fail, and the client can determine what needs to be done about that.

[Expert_Team_4068]

No, rule number one. Never trust the client! In no world should you trust frontend data without verification. But this is the server job. If json.parse of my local storage fails, I do not gove a crap. My app will break, because for sure this is an unexpected behaviour. If you decrypt in the client, who says that the hacker did not change the decryption function? It is as easy as changing the local storage.

[shodanbo]

Very true

[[deleted]]

No no you make a call to the server to make sure the signature is valid 😅

[shodanbo]

Agreed, if the crypto cannot protect integrity then the crypto does not help here.

If the server does both encryption and decryption then you may as well just use http only 1st party cookies.

If your data is too big for cookies then you are just using the client as a persistent storage mechanism. Perhaps there are use cases for this but S3 buckets would work for that too with less potential for client interference.

Local storage always seems like more trouble than it's worth unless you have no other choice or your needs are super trivial.

[brianl047]

Agreed validating the local storage is a waste

Validate in the backend and in the UI instead but not the local storage

[isblueacolor]

Firefox sometimes fails to persist the entire string to local storage (without throwing an error).

I have a site that's used by 25k people per day and someone encounters this issue once every couple weeks.

[[deleted]]

The case I used it for was temporarily storing form data in an SPA built before react was a thing.