0

Consider two backend servers:

https://server1.example.com
https://server2.example.com

When accessing these servers directly, they naturally have independent localStorage objects, since their origins are different; in this case the hostnames differ.

When I place these servers behind a reverse-proxy, they are accessed as follows:

https://proxy.example.com/server1
https://proxy.example.com/server2

To slightly complicate the picture, I have a front-end page on the proxy:

https://proxy.example.com

This front-end page lists the servers as hotlinks using HTML similar to:

<a href="https://proxy.example.com/server1/" target="_blank">Server1</a>
<a href="https://proxy.example.com/server2/" target="_blank">Server2</a>

Now, each of the servers proxy, server1 and server2 all pass the same-origin test, since they each have origin=https://proxy.example.com:443. Consequently, the localStorage object is shared among them and this sharing is confusing the apps on server1 and server2.

Is there a way to disable sharing of localStorage between proxy, server1, and server2 in this configuration?

If not, are there methods in Javascript that will disable sharing between these entities?

0

There's no way as far as I know to have the browser segment localStorage based on anything other than the origin, and there's no way to change the origin other than changing the URL.

If your goal is to segment your stored data by site to avoid conflicts, you'll have to do that manually by assigning each site some unique key under which it can store it's data.

If your goal is to prevent server1 from reading/writing to server2's storage, that won't be possible without changing the server's origins.

  • Thanks kicken, that confirms my suspicions too. I ended up modifying the localStorage keys with the reverse-proxy substitute command. So now, the keys are server-specific. E.g. a key called foo is now subsituted by the reverse-proxy to become server1_foo and server2_foo. This fixed the sharing issue. – Matt Muggeridge Oct 3 '18 at 8:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.