Question

I have a lobby written in HTML5 / javascript. A .json file provides a few config parameters for the lobby and for the various other HTML5 games that can be launched from it. These parameters can either be passed to the games in the window.open string ( in the form of:

window.open(http://www.myLovelyDomain.com/index.html?username=bob&token=aaaXXX")

or could be held in localStorage and accessed by the game following it’s launch.

My question is, what is the best (most secure/likely to cause least errors/etc) method? I know users can turn off localStorage, but I don’t know how many do. Any thoughts?

Answer 1

Advantages of localStorage over URL query strings

• Less likely to be user edited
• Less likely to be copy&pasted to someone else
• Can persist across sessions
• Wider choice of characters
• (Marginally) less bandwidth usage (shorter GETs)
• Can store whole files
• Invisible to basic user

Disadvantages

• Server doesn’t get access to the variables without additional ajax
• May be harder to debug
• May need extra checks if things change every session (or consider sessionStorage)
• Not supported by old browsers
• Can’t use cross-domain directly (may be advantage, depending on how you look at it)

For supported list and max sizes see here.