TC-011 - I3 Sensitive client-side storage access
Writing to localStorage
Context profile
The same restrictive Content Security Policy as C1, but no session-like cookie is present.
Content Security Policy
default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none' Cookies
| Cookie | Type | HttpOnly | Secure | SameSite |
|---|---|---|---|---|
tc_ui_theme | non-session | no | no | Lax |
Cookie values are placeholders and are never collected. Of these attributes only HttpOnly decides whether JavaScript can read the cookie.
Test case
The script writes a value to localStorage. The finding is that the code uses Web
Storage. Run under C2, a neutral cookie context, so the storage finding is not strengthened by
unrelated session-cookie context.
Script output
What to observe
- The value written (
a1b2c3d4e5f6) is opaque: it could be a token, or a harmless cache key. Nothing in the write says which. - You can confirm the write in DevTools under Application → Local Storage for this origin.
The finding on localStorage is technically correct, but ambiguous: the tool cannot
tell whether the stored value is sensitive from the write alone. Do not assume it is. TC-013 pairs
with this case as a clearly low-risk use of the same API.
Expected outcome
- Purpose
- Check whether Web Storage access is reported.
- Expected finding
- Finding on localStorage use.
- Expected interpretation
- Technically correct storage indicator; relevance depends on the nature of the stored value and later use.
- Expected priority
- Low to medium (C2)
- Notes
- Do not assume that the stored value is sensitive.
Expected priority is shown for the active context profile. Other profiles for this case: C2.