10

It seems stackauth.com has used some local storage which my Safari does not show me, and hence cannot be deleted. So, in general: how to ensure all local storage is deleted from Safari?

Some background and details:

The HTML5 Local Storage allows websites to store information on a computer. (That's a bit like cookies, but the contents are not sent to the server automatically.) Like when one has once logged in to the (new) Twitter website, then when viewing that site and pasting the following into the location bar shows a lot of details, even when not currently logged in:

javascript:alert(localStorage.getItem(':USER:'));

To get rid of this data: in Google Chrome "Delete cookies and other site data" does the trick. In Firefox, it's deleted whenever cookies are deleted. Not so much in Safari.

In Safari there seems to be a related preference in Security, button "Show databases". However: that list of "Show databases" in Safari does NOT mention stackauth.com, as used by the Stack Exchange global network auto-login. And after using "Remove all", I still get results on that site:

javascript:alert(localStorage.getItem('GlobalLogin'));

I could delete this by using javascript:localStorage.clear();. But then I need to know that a site has stored data. This question is not just about StackAuth; I want to be sure other sites are not hidden from the list as well.

(I'm on a Mac, using the latest Safari on the latest OS X.)

When the popup is too large to see any close button, then hit Esc or Return to close the alert dialog.

3 Answers 3

4

In recent versions of Safari (I am on 5.1 now), local storage can be cleared with Safari » Reset Safari » Remove all website data. Or by using Safari » Preferences » tabsheet Privacy » Cookies and other website data » Remove All Website Data. And even by using Remove All when viewing the details on that very same Privacy tabsheet. The Security tabsheet no longer shows any button to view the databases.

Some more details, also for older versions:

On my Mac, I found the folder ~/Library/Safari/LocalStorage, which has a file for each site that uses local storage, with its creation date set to my very first visit to each site. On Windows, this might be in a folder like %APPDATA%\Apple\Safari or %APPDATA%\Apple Computer\Safari.

Deleting all those files, and restarting Safari, obviously cleared the data for StackAuth too.

However, logging in to a random Stack Exchange site gets me the StackAuth data again, and a file in the above folder, without ever being prompted to allow that (my Safari preferences show "Database storage: none allowed before asking"), and without the domain being shown in the "Show databases" list. This also happens in private browsing modes.

This seems to be caused by the difference between HTML5 Web Databases, and HTML5 Web Storage (the latter including local storage). Chrome shows both for Twitter:

Databases and local storage in Google Chrome

Apparently Safari only warns for databases, not for local storage? Maybe blocking local storage is going to be as hard as stopping Adobe Flash from leaving its privacy trail. The specifications state:

User agents should expire data from the local storage areas only for security reasons or when requested to do so by the user.

Let's hope someone knows of an easier way, or that we get some more control in future releases. (I filed a feature request at Apple for that.)

In my case, I found as many as 5,904 items dating back to March 2009. And even my own domains, for which I'm sure no local storage is used, were listed with 8kb files each. Investigation shows that Alexey Ruzanov's FlashBlock user script uses local storage too, and hence causes a file for each site one visits, regardless whether it uses local storage, and regardless whether it uses Flash.

1
  • Ah, I almost got fooled here: explicitly clicking "Don't allow" when prompted "Allow this website to use space on your disk? — The website “twitter.com” is requesting 1 MB of disk space to store “html5 test db” as a database on your disk", still got me the data when doing the JavaScript trick, and a 8kb file on disk. However, restarting Safari shows that this data has not been stored (or at least: is not accessible).
    – Arjan
    Jan 22, 2011 at 22:04
2

My solution is a bit different:

On Windows:

  1. Hold Ctrl + Alt + C.
  2. Enter the following code into the window that pops up and click the Enter key: localStorage.clear()

On Mac:

  1. Hold Cmd + Opt + C.
  2. Enter the following code into the window that pops up and click the Enter key: localStorage.clear()
0

In the last few versions of Safari (version 13 as of this post) you can go to Preferences > Privacy > Manage Website Data… and then remove all data by domain.

Safari 13 website data manager showing Superuser.com

1
  • Indeed, this was fixed in October 2011 :-) Note that websites do not limit tracking to their main domain: when browsing Super User you'll also get tracking from Google, which likely is not cleared by the procedure in your screenshot. (Aside, when privacy is really important, one better use private browsing windows, along with Tor, and maybe even a different user, and keep the browser updated. People always come up with new ways to track visitors, and browsers will have design flaws a.k.a. bugs.)
    – Arjan
    Mar 20, 2020 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .