← Back to index

Storage security

Untrusted data from URL/storage written into Web Storage sinks.

INLINE-1 (High): query/session → localStorage + sessionStorage
const payload = location.search || sessionStorage.getItem('cached');
localStorage.setItem('secret', payload);
sessionStorage.setItem('profilePayload', payload);