Web storage is blocked in this browser window. Tests will not run correctly.
Organization settings: Authentication
Real setting allows 5–480. 1 is allowed here for testing.
Sign in
Login required
Simulated. Any password is accepted. The password is not stored.
- User
- Signed in by
- Stored in
- Storage keeps it
- Token expires
- Token time left
- Idle for
- Login server session
Expiry and inactivity are checked when a request is sent, as on a real server. Refreshing the page also sends a request.
This tab
- Tab ID
- Loads in this tab
- Other open tabs
- 0
Tab ID is kept in sessionStorage. A new ID means a new session. The same ID means the session was copied or restored.
Event log
Storage
localStorage
sessionStorage
Cookies
The login server session is simulated with a cookie, poc_login_session. DevTools: Chrome/Edge F12 → Application. Firefox Shift+F9 → Storage. Token key: poc.authToken
Test plan
Tests 1–13: set Login server session to Off and Inactivity timeout to disabled. Tests 14–16 list their own settings.
| Test | Expected: Persistent | Expected: Session | Persistent | Session |
|---|
Results are saved per browser. Run the plan in each browser and copy the results.
Test environment
Overview
localStorageandsessionStorageare the two parts of the Web Storage API, defined in the WHATWG HTML Standard.- Both store string key–value pairs, read and written with JavaScript.
- Both are scoped to an origin (protocol + host + port).
http://andhttps://on the same host are separate origins. - Neither is sent to the server automatically. The app attaches the token to requests, for example in an
Authorizationheader. - Data is not shared between browsers, browser profiles or devices.
localStorage vs sessionStorage
| Behaviour | localStorage | sessionStorage |
|---|---|---|
| Scope | Origin; shared by all tabs and windows | Origin + one tab |
| Refresh / navigate in same tab | Kept | Kept |
| New tab or window | Shared | New, empty |
| Duplicate tab | Shared | Copied; independent afterwards |
Opened by window.open() with opener | Shared | Copied; independent afterwards |
| Close tab | Kept | Cleared |
| Reopen closed tab | Kept | Restored |
| Browser restart | Kept | Cleared, except where session restore brings it back (see below) |
| Expiry | None. Removed by code or by clearing site data. | Ends with the tab |
Token expiry (exp claim) | Separate from storage. The app or server rejects an expired token in both modes. A token without exp stays valid for as long as storage keeps it. | |
| Private window | Separate store; deleted when the last private window closes | Per tab |
| Size limit | 5 MiB per origin | 5 MiB per origin |
| Readable by page scripts | Yes | Yes |
storage event | Fires in other tabs of the origin | Fires only in frames of the same tab |
Browser differences: Chrome, Edge, Firefox
Chrome and Edge use the same engine (Chromium) and handle Web Storage the same way. Firefox uses Gecko.
| Item | Chrome | Edge | Firefox |
|---|---|---|---|
| Duplicate tab | Right-click tab → Duplicate | Right-click tab → Duplicate tab, or Ctrl+Shift+K | Right-click tab → Duplicate Tab |
| sessionStorage on duplicate | Copied | Copied | Copied |
| Reopen closed tab | Ctrl+Shift+T (Cmd+Shift+T on macOS). sessionStorage is restored in all three. | ||
| Restore-tabs-on-startup setting | Settings → On startup → Continue where you left off | Settings → Start, home, and new tab page → Open tabs from the previous session | Settings → General → Startup → Open previous windows and tabs |
| sessionStorage after restart with that setting on | Not restored (reported). Verify with test 7. | Not restored (reported). Verify with test 7. | Restored |
Link with target="_blank" (noopener by default) | New, empty sessionStorage | New, empty sessionStorage | New, empty sessionStorage |
window.open() keeping opener | sessionStorage copied, then independent (WPT storage_session_window_open) | ||
| Private mode | Incognito (Ctrl+Shift+N) | InPrivate (Ctrl+Shift+N) | Private Window (Ctrl+Shift+P) |
| Clear site data on exit (removes localStorage) | Settings → Privacy and security → Site settings → On-device site data | Settings → Privacy, search, and services → Delete browsing data → Choose what to clear every time you close the browser | Settings → Privacy & Security → Cookies and Site Data → Delete cookies and site data when Firefox is closed |
| DevTools location | F12 → Application → Storage | F12 → Application → Storage | Shift+F9 → Storage |
| This POC | Supported | Supported | Supported |
Settings paths are from current desktop versions and may be worded differently in older releases or under organization policy.
Related settings modelled in this POC
- Token storage location: Persistent is the default. Saving a change asks for an acknowledgment, and declining cancels the change.
- Login server session: a cookie on the login server keeps a sign-in session (default 30 minutes; selectable here from 1 minute to 24 hours) during which new tokens are issued without a password. In Session mode this decides whether a new tab asks for a password.
- Inactivity timeout: 5–480 minutes. Any request resets the timer, including background requests the app makes. The timeout takes effect at the next request after it has passed.
- Token expiry or timeout: standard organizations re-authenticate automatically. HIPAA-enabled organizations require the password and have a 15-minute inactivity timeout by default.
- The storage location changes where the browser keeps the token. It does not change token lifetime, inactivity timeout or the login server session.
API
localStorage.setItem('authToken', token); // same methods on sessionStorage
localStorage.getItem('authToken'); // null if missing
localStorage.removeItem('authToken');
localStorage.clear(); // all keys for this origin
window.addEventListener('storage', e => { // change made in another tab
if (e.key === 'authToken' && e.newValue === null) signOut();
});
Calls are synchronous. Writes throw QuotaExceededError when the limit is reached.
Security facts
- Any JavaScript running on the origin, including injected script (XSS), can read both stores.
- sessionStorage limits how long the token stays in the browser. It does not limit who can read it while the tab is open.
- OWASP: do not store session identifiers in localStorage; use sessionStorage when persistence is not needed;
HttpOnlycookies are not readable by JavaScript. - Token expiry is enforced by the server, independent of where the browser stores the token.
References
- MDN: Web Storage API
- MDN: Window.localStorage
- MDN: Window.sessionStorage
- MDN: Storage quotas and eviction criteria
- WHATWG HTML Standard: Web storage
- OWASP HTML5 Security Cheat Sheet
- Web Platform Tests: webstorage (storage_session_window_open, storage_session_window_noopener)
- Chromium: do not clone sessionStorage for noopener windows
- Eric Lawrence: Undead session cookies (session restore behaviour)
- webdbg.com session test page
- Mozilla Bug 1501594: sessionStorage restored with session restore
- Mozilla Support: Restore previous session