Is the data used in session with localStorage in ionic application safe?

Question

I'm doing an application in ionic and i need to use session to maintain data. I use localStorage but i want to know is it safe for sensitive data?Is there a way encrypt the data or other way to make it safe?Or is there another way to make session in an ionic application?

Answer 1

I wanted to see your answer about what you call "sensitive information", before creating this answer, and now that I know it, Why would you want to keep information like the password in the local storage? First of all, you should not know your user's passwords at all, you should just save a hash of your user's password in your database and only that. Your cookies, local storage and all those client-side storage mechanisms are just for user preferences, session tokens and stuff like that, and it should never be used to store sensitive information, since that information can be modified by the user or even worse, it might be readed by an attacker.

I know that your question is about a safe way to store this information in the client side, but the answer here is that you should not be doing that at all. Yes, you could do something like encrypting the information (and only decrypting in your server, since to do it in the client side, you'll need the key and again, the key can be readed by an active attacker and then he'll be able to decrypt the information), but information like that has no reason to be stored in the client side, if you're doing it for authentication purposes, then you should be using sessions and cookies.

Maybe I got it wrong and you're doing it for a particular reason, and if it's like that, feel free to tell me that reason, so we can find a different solution, because I'm 100% sure that you don't really need to store information like the password.