17

As more and more sites switch from using cookies to using localStorage to store their data (including "tracking bugs"), I'm concerned about in how far the user can control this. With cookies, one could set up the appropriate policies, e.g. block 3rd party cookies, or being always asked. I could not find a corresponding setting for localStorage.

Searching SU, I found a similar question for Chrome: disable HTML5 LocalStorage and Databases for all webpages /or ask user. I've also read How to allow local storage for one specific userscript, but disable it globally? (which does not answer my question) and Firefox local storage and cache questions (which also states missing documentation, but does not answer my question). I found almost nothing on a Google search.

Trouble I've had in the beginning with SE in general (see MSO) and solved thanks to Eric's Blog let me assume the cookie settings are at least connected to localStorage somehow; but as it's not documented, I don't want to rely on "try-and-err" with one FF version to draw general conclusions from.

Is there some documentation on that? I'd count it a big privacy intrusion if the user cannot control which site is storing data into localStorage, so it must be possible somehow.

TL;DR: Is it done corresponding to the cookie policy − or if not, how can a user control it?

Improve this question

4 Answers 4

Reset to default
13

Firefox's relationship between cookies and localstorage (from https://bugzilla.mozilla.org/show_bug.cgi?id=341524):

  • disabling cookies disables storage, unless the site is on the whitelist.
  • enabling all cookies enables storage, except if the site is on the blocked list.
  • if a site is set to session only in the block list, only session storage may be used. Global storages are treated like session storages.
  • similarly, if the cookie preferences are set to session only, all storage usage is session only
  • if the cookie preferences are set to prompt, this is treated the same as reject cookies. Not sure whether we want prompting to occur here. Do cookies prompt every time a cookie is set, or just once per session?
  • the hidden preference dom.storage.disabled can be used to disable DOM storage.

Thus, you should be able to use cookie managers such as Cookie Monster to control localstorage.

To view/delete persistent localstorage in Firefox, you can use Foundstone HTML5 Local Storage Explorer or NoTrace. Other related Firefox extensions are listed here.

From How to clear and disable DOM Storage in Firefox, IE and Chrome:

Clear DOM Storage in Firefox:

Select “Tools” -> “Clear Recent History”, open “Details”, check “Cookies” and select “Everything” as time range.
ATTENTION: No other time range will clear the DOM Storage.

[...]

Disable DOM Storage in Firefox:

Type "about:config" in your address bar and hit enter to view your internal browser settings. Scroll down to "dom.storage.enabled", right click on it and hit "Toggle" to disable the DOM Storage.

From Bypassing the intent of blocking "third-party" cookies:

In concept, HTML5 Local Storage is very similar to cookies. On a per-origin basis, there is a set of disk-persisted name / value pairs.

With a simple test, it's easy to show that the HTML5 Local Storage feature is not affected by the third-party cookie setting.

Mozilla knows about this issue: Bug 536509 - localStorage does not obey "third-party cookies" pref. Fortunately, if you untick Firefox checkbox "Accept cookies from sites," then localstorage is enabled only on domains that are allowed in Firefox's cookie Exceptions list. Since JavaScript is needed to set localstorage, JavaScript blocking extensions like NoScript can also mitigate this issue.

Localstorage test sites:

Firefox issue: Bug 748620 - When cookie expiration is set to ask every time, localStorage throws a security exception.

All of the information in this answer was adapted from DOM storage: browser data storage that can bypass the intent of blocking third-party cookies, a thread that I started.

Improve this answer
3
  • Thanks a lot for your comprehensive answer! No detail left open :) And yes, I use that Foundstone addon already for a while to investigate. Also checked the corresponding databases with SQLiteman. What I was lacking you filled in: As the described cookie policy matches mine (unticked that checkbox, have non-whitelisted sites ask first), I feel backslapped :)
    – Izzy
    Jun 21, 2014 at 21:21
  • You're welcome! Please see Bug 748620 in my answer also.
    – MrBrian
    Jun 21, 2014 at 21:55
  • That's what it's set here. Got no exception yet. Maybe the sites using LocalStorage here (e.g. SE) are limited to those having "full cookie permission", so I was not bugged by that bug (yet). And yeah, a 2012 bug still unsolved. I rawly remember it hit me when I just joined SE (as stated in my question), and had trouble logging in...
    – Izzy
    Jun 21, 2014 at 22:24
3

I am the developer of the Cookie Controller addon, and it will show you the permissions that apply to local storage (and session storage) as well as letting you set those permissions.

However, to answer your original question, permissions for DOM storage are essentially the same as for cookies. Certain permissions, such as 3rd party, do not apply, but the settings to deny cookies or restrict them to the current session are also applied to DOM storage. Unfortunately Firefox will not show you whether a web page is using DOM storage or not so it can be difficult to verify. Hence the addon is useful.

There is also a hidden preference that will completely disable all DOM storage independently of cookies: dom.storage.enabled. This is a little brutal and usually you would just block cookies to block storage. Equally, exceptions set to allow individual web sites to set cookies also allow them to use DOM storage.

Lastly, there is a limit on the amount of storage that can be used by each web page. By default this is 5MB but you can change it, potentially to zero. However, web pages don't always handle overflowing this quota very well so you might cause problems by changing it.

Improve this answer
1
  • Thank you for the details explained! I'm using Cookie Controller for a while now, and am quite satisfied with it :) Flash-Cookies I still handle with BetterPrivacy; this is the only thing missing for an all-in-one solution. But the two have no problems with each other, so it's working fine for me.
    – Izzy
    Sep 28, 2013 at 13:38
1

There doesn't appear to be a whole lot of documentation on the feature, but here is the article from the Mozilla Developers Network. In the article it mentions that there are still several bugs open regarding managing local storage (all bugs are open at the time of writing this answer). So at least for the time being it doesn't look like there is any way to manage access to local storage.

Improve this answer
1
  • Thanks. So it looks like it shares the same privacy concerns with the Flash cookies: without technical background the user has absolutely no control over it, and with technical background only limited control in "post-processing". I was afraid of that, you and the linked article confirm it. So maybe we need to raise the issue in some Bugzilla ticket for Firefox.
    – Izzy
    Aug 8, 2013 at 16:08
0

Just found a solution (not yet tried, but according to the comments it should do): There's a Firefox addon called Cookie Controller, which seems to handle "old-style" cookies and DOM storage (unfortunately, Flash-cookies aka LSO seem not to be dealt with; which would make it the complete controller):

Cookie Controller: Per-site Cookie Controller: Global
Cookie Controller: Per-site and Global settings

Using this addon, one should be able to use global and per-site settings for localStorage. As localStorage is required for SE sites, per-site settings are to be preferred here :) It even offers to delete selected "cookies" at session end (all except white listed, e.g.).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .