Reasons to use/not use HTML local storage?

[Cantor, Scott]

On 11/23/15, 6:01 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>If I'm opening myself up to potential security risks or potentially breaking support for clients (even those that do support Javascript), it's obviously not time yet. I guess my question comes down to how production ready is this feature?

Well, I don't know what we don't know. But I think that's overstating it on both counts.

Even if the local storage data were easier to hack into than cookies, which I doubt, it's still encrypted and protected by a key so nobody can forge it or change it, and unless you turn off address checking, stealing it isn't going to buy anybody anything.

And the implementation is adaptive. Unless it fails to accurately detect that local storage isn't available, which you could patch on the fly if you had to, it will just back off to cookies and do exactly what it's already doing now, and it will automatically disable the features that need the extra space, so it just turns back into the same as what you have now.

I wouldn't necessarily go off and build out logout and announce it on your service blog in case something goes wrong and you have to hold off delivering it, but I don't know what would prevent somebody from at least trying it.

-- Scott