3 ms·
That’s exactly what I was thinking also. Local storage is protected by the origin access policy. If that is compromised by XSS, it doesn’t matter how or where t
by brianhama 9y ago
That’s exactly what I was thinking also. Local storage is protected by the origin access policy. If that is compromised by XSS, it doesn’t matter how or where the data is stored; it’s accessible.
- Klathmon 9y agoIt doesn't even need to be "stored", an XSS attack can pull information that is simply displayed on the page. When it comes to web-apps, XSS is game over. It's the web equivalent of remote code execution.