Issue with attribute release consent

[Cantor, Scott]

The implementation of the storage service relies on non-session-based LocalStorage for everything. The session vs. persistent distinction has to do with the use of cookies (which are not used when local storage is), because there are different use cases where each makes sense.

The use of session storage doesn't work for the client storage service use case because there are very tight rules on how different tabs see the storage.

With non-session storage, the data is meant to persist, but of course that is up to the client. It can obviously be destroyed at any time, along with other browser state, and there are ways to get the browser to destroy it at shutdown, etc.

> It really seems like the local storage is getting removed (or corrupted) after about a day after working without
> issue.

Possible, but it's not the IdP doing it. Quite obviously, if you want to use it for consent, you can't be having the browser get rid of it every day though. Where as for sessions that's probably fine. The records internally have their own expiration so none of this is a security question, the server will just ignore (and remove) expired data and save the map back without them.

-- Scott