In this way when the user closes the tab he knows for sure that the session is gone. We now have what is probably the most secure way to cache session tokens in the browser and without compromising the multiple tabs user-experience. The data is shared through the event payload and not the localStorage itself.Ĭlick to “Set the sessionStorage” than open multiple tabs to see the sessionStorage is shared. The sessionStorage data will not stay in the localStorage, not even for 1 millisecond as it being deleted in the same call. If any other tab is opened it’ll send us the sessionStorage through localStorage event, we’ll duplicate that into the sessionStorage. When a user opens a new tab, we first ask any other tab that is opened if he already have the sessionStorage for us. The way I solved it is by using localStorage events. Share sessionStorage between tabs using localStorage events Right, sessionStorage is not shared across tabs. The afordmentioned security enahncment of saving the token in the sessionStorage will create some bad UX in the form of requesting the user to re-login with every tab he opens. It is pretty common even in single page application that the user will want to use multiple tabs. When the user closes the tab – it’s gone. We save the token in the sessionStorage, send it as an header with every request to the server in order to authenticate the user. Hence the user may navigate to different pages and/or refresh the page and still remain logged-in. The benefit of the sessionStorage is that it’ll persist across different pages and browser refreshes. This leaves us with saving the token in the memory or in the sessionStorage. (We should anyway consider to not use cookies since these have other problems that are need to be dealt with, i.e. CSRF.) Even session-cookies will not suffice since it’ll continue to live after closing the tab and even after completely closing the browser. In order to support that, one should never use cookies to store any sensitive data like authentication tokens. When dealing with critical platforms it is expected that the session is ended when the user closes the tab. Session cookie ~4KB, deleted when the user closes the browser (not always deleted)
0 kommentar(er)
