Home/ Questions/Q 8966067
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T16:56:44+00:00

I’m building a Sencha Touch 2 application that retrieves data from a webservice. It’s

  • 0

I’m building a Sencha Touch 2 application that retrieves data from a webservice. It’s been decided that it’d be a good idea to use an optional PIN setting on the app for extra security when you launch the app from idle. I’m not really sure what the best way to manage this is.

The web service isn’t capable of storing the PIN itself, and the app is also designed to be used offline as well as online, so the number needs to be stored on the device itself in local storage. I’m not convinced this is providing any level of security, and I’m also concerned that on iOS local storage is apparently treated as temporary so setting the number in local storage doesn’t necessarily mean it’s always going to be there.

The webservice already returns an expiring auth token to the device on which is required for all requests to the API. To my mind that’s secure enough, but the idea of the PIN seems to be important to the client.

How would you manage this requirement?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Unlike cookies which passed between server/client (and could be accessed by both of them), sessionStorage / localStorage are 100% stored in the client by a concrete browser, sessionStorage temporarily stores data in one HTTP session, localStorage stores permanent data into client hard disk. The advantage is obvious:

    • Data won’t be passed through HTTP request/response, bandwidth will be saved.
    • There will be no 4KB limitation, web site has much more flexibility to store large data in client.
      Note: W3C “recommended 5 megabytes localStorage size limitation per domain”, and “welcome feedback”, this is much larger than 4KB limitation in cookie.
    • Now that data won’t be passed through network, this will be relatively more secure.
    • Considering further according to #3, a number of existing HTTPs connection in theory could use plain HTTP by adopting Web Storage, because there is no need to encrypt the data, the data is stored in client side. Since HTTPs usually have only 10% performance comparing with HTTP, eventually either performance will be improved or cost is saved (procuring cheaper server hardware).

    So I (personally) would give localStorage a try :). If you want more security you can additionally encrypt your pin before storing it into localStorage e.g. http://point-at-infinity.org/jsaes/

    • 0