Home/ Questions/Q 8142873
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-06T12:56:31+00:00

I’m attempting to use localStorage as a cookie replacement (detest cookies) so users can

  • 0

I’m attempting to use localStorage as a cookie replacement (detest cookies) so users can stay signed in on a site I operate.

What I planned so far was to save the user’s username in localStorage, and have the site check whether anything was in localStorage, and if anything is in localStorage, it’d push the localStorage data to a PHP file via POST and push the user to start a new PHP session and return them back to where they were.

Though I have the concern, I know localStorage can be viewed, in which case possibly encrypting the data server-side would make some sense.

But can LocalStorage data be modified? If not, this would be fine to do, even without encryption, but obviously if a user could modify the localStorage data, they would have access to others’ accounts, which as you can imagine, isn’t a good thing.

I had the doubt because JavaScript can be executed by a client in a browser, ie:

javascript:alert("hello");

Couldn’t it be possible to find out the localStorage’s var name and reset it’s value like this?

javascript:localStorage.setItem('sessionusername','superadmin');

Basically, I ask: Can HTML5 Local Storage data be modified on client side?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Local storage is bound to the domain, so in regular case the user cannot change it on any other domain or on localhost.

    It is also bound per user/browser, i.e. no third party has access to ones local storage.

    Nevertheless local storage is in the end a file on the user’s file system and may be hacked.

    • 0