3 ms·
I'm not entirely sure what you are asking here. IndexedDB is subject to the same origin policy, so only javascript executed on my domain can access the data fo
by Klathmon 9y ago
I'm not entirely sure what you are asking here.
IndexedDB is subject to the same origin policy, so only javascript executed on my domain can access the data for my domain.
Combined with a good Content-security-policy means I'm in control of exactly what code gets to access those resources.
- walterbell 9y agoSome discussion here: https://news.ycombinator.com/item?id=16250519 https://news.ycombinator.com/item?id=16250519
- Klathmon 9y agoAh, so in that case yes, it's safe from the extreme majority of XSS, because I use Content-Security-Policy headers. Any cookies would also be subject to XSS, unless they have the HTTP-Only flag set, in which case the whole point is not worth discussing because JavaScript cannot access it or even know it exists, so it would obviously be useless to any javascript. Localstorage (and friends like WebSQL and IndexedDB) and Cookies serve different purposes, and having data in IndexedDB is no less "secure" than having it displayed on the page. In both cases an XSS attack means game over.