Html HTML5 本地存储安全
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/3718349/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
HTML5 localStorage security
提问by Aleris
Would be a good or bad idea to use localStorage for sensitive data (assuming the current HTML5 implementations)?
将 localStorage 用于敏感数据是一个好主意还是坏主意（假设当前的 HTML5 实现）？
What methods can I use to secure the data so that it cannot be read by a person that has access at the client computer?
我可以使用哪些方法来保护数据，使有权访问客户端计算机的人无法读取数据？
回答by Sripathi Krishnan
Bad idea.
馊主意。
- Someone with access to the machine will always be able to read the localStorage, there is nothing much you can do to prevent it. Just type 'localStorage' in firebug console, and you get all the key/value pairs nicely listed.
- If you have an XSS vulnerability in your application, anything stored in
localStorageis available to an attacker. - You can try and encrypting it, but there is a catch. Encrypting it on the client is possible, but would mean the user has to provide a password andyou have to depend on not-so-well-tested javascript implementations of cryptography.
- Encrypting on the server side is of course possible, but then the client code cannot read or update it, and so you have reduced localStorage to a glorified cookie.
- 有权访问机器的人将始终能够读取 localStorage，您无能为力。只需在萤火虫控制台中键入“localStorage”，您就可以很好地列出所有键/值对。
- 如果您的应用程序中存在 XSS 漏洞，
localStorage则攻击者可以使用其中存储的任何内容。 - 您可以尝试加密它，但有一个问题。在客户端对其进行加密是可能的，但这意味着用户必须提供密码，并且您必须依赖未经充分测试的 javascript 加密实现。
- 在服务器端加密当然是可能的，但是客户端代码无法读取或更新它，因此您将 localStorage 简化为一个美化的 cookie。
If it needs to be secure, its best to not send it to the client. What is not in your control can never be secure.
如果需要安全，最好不要将其发送给客户端。不在您控制范围内的东西永远不会安全。
回答by dashersw
Public Key Cryptography can be applied to prevent any kind of intrusion. Also, data integrity checks (such as CRC or hashes) may be used to make sure data is validated by the server.
公钥密码术可用于防止任何类型的入侵。此外，数据完整性检查（例如 CRC 或哈希）可用于确保服务器验证数据。
