Controlled test site Client-side JavaScript security indicators

TC-013 - I3 Sensitive client-side storage access

localStorage for UI preference

lower-risk SQ1SQ3

Context profile

The same restrictive Content Security Policy as C1, but no session-like cookie is present.

Content Security Policy

default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'

Cookies

CookieTypeHttpOnlySecureSameSite
tc_ui_themenon-sessionnonoLax

Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.

Test case

The script uses localStorage to remember a UI theme preference. The API access is the same as TC-011, so the static finding is the same, but the visible purpose is an ordinary, low-risk one: the stored theme styles the preview below.

Preview panel

This box is styled by the theme stored in localStorage. Set tc_theme to light in DevTools and reload to flip it.

Script output

What to observe

  • The stored key is tc_theme and the value is a theme name that visibly styles the preview panel - clearly ordinary UI state, not session or credential material.
  • The same localStorage API as TC-011 is used; only the visible purpose differs - here you can see what the stored value is for.

The finding on localStorage is technically correct, but lower-risk because the purpose reads as ordinary UI state. This case exists so that not every storage finding is interpreted as equally serious - the contrast with TC-011 is the point.

Expected outcome

Purpose
Check that low-risk storage use is treated as a technically correct but less relevant finding.
Expected finding
Finding on localStorage use.
Expected interpretation
Technically correct storage indicator, but lower-risk because the visible purpose is low-risk.
Expected priority
Low (C2)
Notes
Prevents all storage findings from being interpreted as equally serious.

Expected priority is shown for the active context profile. Other profiles for this case: C2.