Reasons to use/not use HTML local storage?

[Wessel, Keith]

Thanks, Scott.

I've thought a bit more about this after reading your reply. Since this feature is smart enough to fail back to cookies, I'm guessing that means everything fails back to that kind of behavior when failing back is necessary. So, if I use SAML logout and HTML local storage is available, life will be great. But if a client that doesn't support HTML local storage uses that same SAML logout endpoint, will they get an ugly error fro the IDP? That is what gets stored in the cookie (rather than the HTML local storage) if idp.session.trackSPSessions and idp.session.secondaryServiceIndex are enabled? Will it put as much into the cookie as will fit and it'll be hit or miss if SAML logout works?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, November 23, 2015 8:02 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Reasons to use/not use HTML local storage?

On 11/23/15, 6:01 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>If I'm opening myself up to potential security risks or potentially breaking support for clients (even those that do support Javascript), it's obviously not time yet. I guess my question comes down to how production ready is this feature?

Well, I don't know what we don't know. But I think that's overstating it on both counts.

Even if the local storage data were easier to hack into than cookies, which I doubt, it's still encrypted and protected by a key so nobody can forge it or change it, and unless you turn off address checking, stealing it isn't going to buy anybody anything.

And the implementation is adaptive. Unless it fails to accurately detect that local storage isn't available, which you could patch on the fly if you had to, it will just back off to cookies and do exactly what it's already doing now, and it will automatically disable the features that need the extra space, so it just turns back into the same as what you have now.

I wouldn't necessarily go off and build out logout and announce it on your service blog in case something goes wrong and you have to hold off delivering it, but I don't know what would prevent somebody from at least trying it.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net