Ah, so in that case yes, it's safe from the extreme majority of XSS, because I use Content-Security-Policy headers. Any cookies would also be subject to XSS, u

Ah, so in that case yes, it's safe from the extreme majority of XSS, because I use Content-Security-Policy headers. Any cookies would also be subject to XSS, unless they have the HTTP-Only flag set, in which case the whole point is not worth discussing because JavaScript cannot access it or even know it exists, so it would obviously be useless to any javascript. Localstorage (and friends like WebSQL and IndexedDB) and Cookies serve different purposes, and having data in IndexedDB is no less "secure" than having it displayed on the page. In both cases an XSS attack means game over.