Is it okay to store session id in localStorage?

Question

Is it secure to store user's session id in localStorage? On w3.org site, they say

User agents must raise a SECURITY_ERR exception whenever any of the members of a Storage object originally returned by the localStorage attribute are accessed by scripts whose effective script origin is not the same as the origin of the Document of the Window object on which the localStorage attribute was accessed.

So does this mean localStorage could be used for sensitive data?

Answer 1

It depends upon what you mean by "is it secure"?

localStorage is about as secure as a non-path restricted cookie. From web pages, it can only be accessed by pages from the same domain. Zillions of sites store session ids in cookies which have about the same security restrictions as localStorage.

Outside of web pages, neither localStorage nor cookies are secure at all from access by other programs or even web debugging tools running on the same computer.

Answer 2

httpOnly cookies provide a layer of XSS defence that localStorage does not provide:

• httpOnly cookies are not accessible from [potentially malicious] JS.
• localStorage is accessible from JS.

Session IDs should be stored in httpOnly secure cookies.