3 ms·

If you need to store non-trivial amounts of offline data then native is your only option.

by Joeri 9y ago

Klathmon 9y ago
That's not necessarily true, depending on what your definition of "non-trivial" is. I currently use IndexedDB to store over 500mb of data on phones successfully in a B2B application. The biggest issue in my experience is access to native "well optimized" APIs. (If I want a video feed, it causes significantly more battery draw to do it in a webview vs a native camera feed).
- walterbell 9y ago
  Is that local data safe from 3rd-party javascript?
  - Klathmon 9y ago
    I'm not entirely sure what you are asking here. IndexedDB is subject to the same origin policy, so only javascript executed on my domain can access the data for my domain. Combined with a good Content-security-policy means I'm in control of exactly what code gets to access those resources.
    - walterbell 9y ago
      Some discussion here: https://news.ycombinator.com/item?id=16250519 https://news.ycombinator.com/item?id=16250519
      - Klathmon 9y ago
        Ah, so in that case yes, it's safe from the extreme majority of XSS, because I use Content-Security-Policy headers. Any cookies would also be subject to XSS, unless they have the HTTP-Only flag set, in which case the whole point is not worth discussing because JavaScript cannot access it or even know it exists, so it would obviously be useless to any javascript. Localstorage (and friends like WebSQL and IndexedDB) and Cookies serve different purposes, and having data in IndexedDB is no less "secure" than having it displayed on the page. In both cases an XSS attack means game over.
kaycebasques 9y ago
Not true, many browsers give decent offline data storage quotas. Although one of the benefits of PWAs is that you often reduce your data footprint on your users devices. The extreme canonical example has been Twitter PWA compared to Twitter native. See link below for per-browser storage quota: https://developers.google.com/web/ilt/pwa/live-data-in-the-service-worker#how_much_can_you_store https://developers.google.com/web/ilt/pwa/live-data-in-the-s... Disclaimer: I work on Google Web DevRel

If you need to store non-trivial amounts of offline data then native is your only option.

by Joeri 9y ago

If you need to store non-trivial amounts of offline data then native is your only option.

That's not necessarily true, depending on what your definition of "non-trivial" is. I currently use IndexedDB to store over 500mb of data on phones successfully in a B2B application. The biggest issue in my experience is access to native "well optimized" APIs. (If I want a video feed, it causes significantly more battery draw to do it in a webview vs a native camera feed).

walterbell 9y ago
Is that local data safe from 3rd-party javascript?
- Klathmon 9y ago
  I'm not entirely sure what you are asking here. IndexedDB is subject to the same origin policy, so only javascript executed on my domain can access the data for my domain. Combined with a good Content-security-policy means I'm in control of exactly what code gets to access those resources.
  - walterbell 9y ago
    Some discussion here: https://news.ycombinator.com/item?id=16250519 https://news.ycombinator.com/item?id=16250519
    - Klathmon 9y ago
      Ah, so in that case yes, it's safe from the extreme majority of XSS, because I use Content-Security-Policy headers. Any cookies would also be subject to XSS, unless they have the HTTP-Only flag set, in which case the whole point is not worth discussing because JavaScript cannot access it or even know it exists, so it would obviously be useless to any javascript. Localstorage (and friends like WebSQL and IndexedDB) and Cookies serve different purposes, and having data in IndexedDB is no less "secure" than having it displayed on the page. In both cases an XSS attack means game over.

kaycebasques 9y ago

Not true, many browsers give decent offline data storage quotas. Although one of the benefits of PWAs is that you often reduce your data footprint on your users devices. The extreme canonical example has been Twitter PWA compared to Twitter native. See link below for per-browser storage quota: https://developers.google.com/web/ilt/pwa/live-data-in-the-service-worker#how_much_can_you_store https://developers.google.com/web/ilt/pwa/live-data-in-the-s... Disclaimer: I work on Google Web DevRel