Computers, Programming, Technology, Music, Literature

Client Side Storage Security and Sensitive Information

leave a comment »

Storing ‘Sensitive Information’ on client side is a very risky idea. The definition of ‘Sensitive Information’ differs from one application / business / context to another.

HTML5 localStorage
HTML5 sessionStorage
Cookies
Ideal for Storing Sensitive Information No No No
Ideal for Storing Sensitive Information with Encryption Client Side Encryption could be highly complex to implemet, and is not safe enough, compared to server side encryption.

Read more at “Encryption Options” section below.

Client Side Encryption could be highly complex to implemet, and is not safe enough, compared to server side encryption.

Read more at “Encryption Options” section below.

Client Side Encryption could be highly complex to implemet, and is not safe enough, compared to server side encryption.

Read more at “Encryption Options” section below.

 Persistence Till the item is explicitly cleared with localStorage.removeItemAPI  Till the browser/tab closure Based on a defined DateTime that is done via the Set-Cookieexpires response header
 Expiration No predefined expiration time. The data has to be explicitly cleared with localStorage.removeItemAPI

Also when the browser history is cleared (Ctrl + Shift + Delete)

 During the browser/tab closure

Also when the browser history is cleared (Ctrl + Shift + Delete)

During the browser/tab closure for session cookies (cookies that do not have the expires attribute set via the Set-Cookie response header)

Also when the browser history is cleared (Ctrl + Shift + Delete)

 Ideal for storing session tokens (session identifiers, OAUTH tokens, JWTs) No (because it can be compromised via a XSS attack) No (because it can be compromised via a XSS attack) Yes – provided the following cookie flags are set [httpOnlysecuresamesite=lax or samesite=strict]
Sent with every web request for a matching domain? No No Yes

 

Encryption Options:

Encryption requires a key to encrypt and decrypt sensitive information. In case of symmetric encryption algorithm like AES, there is only one key involved in encryption and decryption. In case of asymmetric encryption algorithm like RSA, there is a private key and public key involved for encryption and decryption.

Anybody with the encryption key can easily decrypt the sensitive information to plain text. Hence the key needs to be protected. The ideal place to save the key is on the server side that is behind a firewall to the internet.

In case of encrypting and decrypting an information on the client side, then the encryption key needs to the transferred to the client and typically a javascript module / library performs encryption and decryption of sensitive information. Because the key is transmitted to the client, an intermediate to advanced computer user can use the key to decrypt the sensitive information, thus breaking the logics of encryption and key storage.

There are advanced ways to make this encryption key to be dynamic for every user session, combining a static encryption key with a nonce (random number to be used only once), however the effort involved in implementing such an approach needs to be traded off against moving the encryption logic to the server side. Optional read about the perils of javascript cryptography – here.

Advertisements

Written by gmaran23

February 13, 2018 at 10:23 pm

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: