6 ms·
> implement async support How can that be possible? The underlying API is blocking and the localStorage interface is not available in web-workers. > But even
by SahAssar 6y ago
> implement async support
How can that be possible? The underlying API is blocking and the localStorage interface is not available in web-workers.
> But even if you wanted to store sensitive data, it wouldn’t be a far stretch to implement some kind of encryption.
Since any other JS runs in the same environment and thread with access to the same resources how would encryption help with the issues in the article?
- Anunayj 6y agoEncrypting all sensitive information that gets stored with a public key received from server. That saves bandwidth compared to cookies, any rouge plugins/javascript won't be able to decrypt the data. (and the client too won't be able to, kinda a bummer). The server will be able to decrypt it obviously since it should have the corresponding private key.
- SahAssar 6y agoAny other JS could still read the encrypted data and exfiltrate it, and use it in the same way as the "real" client since they can both see and use the same data. What you are describing is very similar to how JWT already works (at least in the JWE variant which is encrypted, not only signed). If you want to save bandwidth the easiest way is to have a separate subdomain for API requests or asset requests so you don't send the cookie with asset requests. I don't think that is worth it for 99% of sites though.