0

I have tried looking around about HTML5 Local Storage but I can't seem to find a straight answer.

Does the Local Storage store its objects based on Domain like cookies?

If so how do I access it from another domain?

clifford.duke
  • 3,980
  • 10
  • 38
  • 63
  • http://stackoverflow.com/questions/4201239/in-html5-is-the-localstorage-object-isolated-per-page-domain – paul Apr 16 '13 at 11:42

2 Answers2

2

From the spec:

User agents must throw a SecurityError exception whenever any of the members of a Storage object originally returned by the localStorage attribute are accessed by scripts whose effective script origin is not the same as the origin of the Document of the Window object on which the localStorage attribute was accessed.

You cannot access data stored in localStorage from any domain other than the one that stored it there. It follows the same model as the XMLHttpRequest - the "same origin policy".

James Allardice
  • 164,175
  • 21
  • 332
  • 312
0

If so how do I access it from another domain?

You cannot.

LocalStorage data is created based on the domain of the web page. That data is then only accessible from web pages under the same domain.

Here is why this is a good idea: Would you want a site like hackerz.pwn to be able to read/write/remove this?

Example (page on www.yourbank.com):
window.localStorage.setItem("user_session",  "1234567");
Adam Stanley
  • 1,875
  • 1
  • 15
  • 16
  • That's what I thought, I figured that would be a huge security hole. So just curious, how does StackOverflow manage to handle global authentication using localstorage, they state that it's stored under the stackauth.com domain. – clifford.duke Apr 16 '13 at 13:27