Per-page localStorage?

Question

In HTML5, is it possible to create a localstorage that is accessible only to a single webpage?

I am currently experimenting with possibilities of writing self-contained single-page applications, and whether it is possible for users to host them themselves, e.g. on their Dropbox (which has some basic webhosting capabilities for public files) or by running a minimal webserver on localhost.

A user may then start such HTML Applications from various sources in his local server / Dropbox, or be asked to open one from another users Dropbox.

Since all these pages would be served from the same origin (currently https://dl.dropboxusercontent.com), they would all share a single localStorage, which may both interfere with the functionality if names clash, and leak data; E.g. such a page may want to store the authentication token for accessing the users Dropbox account in localStorage, but then any other such "App" would be able to steal the token.

I have to say here, that I am new to HTML5, and may very well be stretching the intended scope of usage here, as I keep running into limitations due to basic websecurity concepts like the same-origin policy – especially when opening a HTML file from a local drive through a file:// uri.

The core intent is allowing users to host their own custom apps in a manner that works across their mobile and desktop devices, by utilizing their existing webservice subscriptions for both hosting and data synchronization rather than moving their data to yet another service.

If it possible you can use cookies which may be URI sensitive instead of localStorage. If not, you can try to encrypt localStorage data, private key for decryption will be stored in cookies by path. — Andrey Etumyan, Jul 27 '16 at 09:46

score 6 · Accepted Answer · edited May 23 '17 at 12:08

6

As stated here, localStorage is scoped by protocol, domain and port, nothing else.

And with this, even by prefixing each localStorage key by a unique page token (i.e. localStorage.set('page1.' + key)), it wouldn't avoid another page from getting those info, so no simple way to avoid information leak.

edited May 23 '17 at 12:08

Community

1
1

answered Jul 27 '16 at 09:39

magne4000

148
1
10

score 0 · Answer 2 · answered Jul 27 '16 at 09:42

0

You can use unique page identifier (or even url) as a key for encryption of stored data. In theory.

answered Jul 27 '16 at 09:42

zhibirc

164
12

Hum yes, something like a hash in the URL like [ZeroBin](https://github.com/sebsauvage/ZeroBin) does – magne4000 Jul 27 '16 at 09:46
wouldn't that be readable to the theoretical malicous app on the same origin? – kdb Jul 27 '16 at 16:12

Per-page localStorage?

2 Answers2