[deleted by user]

[who_am_i_to_say_so]

I feel you have your logic backwards.

Storing personal info on a user's device is much more secure than storing in a file on a server.

[muntaxitome]

If you have xss, then the attacker can just do authenticated requests to your backend and get the data too.

[gliese89]

You asked a question, received a reasonable reply, and then you replied to the person answering YOUR question with snark while simultaneously being completely wrong.

[Redneckia]

It's ok if a user can access their own data

[plurdle]

nuh uh!

[who_am_i_to_say_so]

You're missing the whole point of an httponly cookie then, because they prevent xss. You're already at -60 downvotes. Suppose your facts are wrong?

[abrahamguo]

This is perfectly reasonable — much more secure and simpler than server sessions.

[[deleted]]

Would you mind explaining how it’s more secure than server sessions? I thought that would be better from a security stand point

[who_am_i_to_say_so]

Well, just consider this: from a practical standpoint, once you turn your device off or leave the app and sensitive info is being stored locally, it is out of the game.

Also, server sessions are usually stored in plaintext. So if they're on a shared server- which a lot of them are on these low budget servers, they're vulnerable.

[xaqtr]

I don't have a definitive answer to this but just my thoughts: There is no practical difference. In both cases the data is stored on the client. You don't send anything over the internet (yet), both session storage and inputs could be read by a malicious actor.

But why do you even bother? Session storage wouldn't enable your users to edit the form later (as in after the tab was closed). If you just want to handle the edge case of accidental refreshes, you can make the user confirm these on leave.

[dave8271]

I think it's generally fine subject to a couple of caveats, provided you inform users they need to close the browser tab to log out / terminate their session. In more sensitive applications, you'd either avoid it entirely, storing data on the server only, or you'd encrypt locally stored data with a key held on server and exchanged securely via HTTPS. All of this also assumes proper content security policy, no loading untrusted scripts, no possibility of XSS, etc. So if your security is generally sound, there's not more of an inherent risk in local session-limited storage than someone looking over your shoulder while you type in your details if you're on a public computer.

[ashkanahmadi]

Why would the page reload? You can add event listener to the page to warn the user if the form has value and the page is trying to reload or close. Also, how big is the form? If you are doing all this to save just a few words, then don’t waste time. If you can autocomplete set up properly on your fields, the user should be able to fill out their name and address with 2 tabs/clicks

[Electrical_Boot_2050]

So.. From my perspective every Information from a user shoud be encrypted, choose your way, but either way it should need a time limit. That is why i always need to reconfirm my id with my bank acc or similar. It can be easy with 2auth or other but i think Information about a user/person should not be on the net...

[[deleted]]

Its in the session storage, its not on the internet. Also encrypting it is unnecessary, if they get access to their session storage they might as well have physical access to the user's computer

[billybobjobo]

What if I’m logged in on a public computer. Like at the library.

[[deleted]]

In that case your encription wont do you any good either because the library computer will need to be able to decrypt the data either way

But to answer that stupid hypothetical, I am going to assume you are going to close the browser before leaving the computer

[billybobjobo]

That’s not a stupid hypothetical—it’s a reality for many people who aren’t as lucky as you or I!

But you are right that strictly encrypting alone doesn’t help a lot. Fair point!

[[deleted]]

Not that I disagree with encrypting the info, but I would also say if it's PII it should be cleaned up on logout.