Use of Session storage and Local storage
Why is this an issue?
Data stored in localStorage and sessionStorage:
Persists beyond sessions:
localStoragedata remains after the browser is closedAccessible to any script: Any JavaScript on the page can access stored data
Not encrypted: Data is stored in plain text
Vulnerable to XSS: If an attacker injects script, they can read all stored data
Storing sensitive information in browser storage creates security risks.
Examples
Example of incorrect code:
// Storing sensitive data in localStorage
localStorage.setItem('authToken', this.userToken);
localStorage.setItem('userData', JSON.stringify(this.sensitiveUserInfo));
How can I fix violations?
Use server-side storage: Keep sensitive data on the server, not in the browser.
Use Salesforce platform cache: For caching, use Platform Cache instead of browser storage.
Minimize stored data: If browser storage is needed, store only non-sensitive, non-identifying information.
Clear on logout: Ensure stored data is cleared when users log out.
When should I disable this rule?
You may dismiss specific violations when storing only non-sensitive preferences or UI state that has no security implications.
Resources