Introduction to Web Storage
Note This article is relevant to Internet Explorer. See Web and Offline Storage for information on Web Storage in Microsoft Edge.
The Web Storage API includes two related mechanisms for persisting client-side data in a secure manner using the Document Object Model (DOM), sessionStorage and localStorage. These objects were introduced in Windows Internet Explorer 8.
Web Storage is often compared to HTTP cookies. Like cookies, Web developers can store per-session or domain-specific data as name/value pairs on the client using Web Storage. However, unlike cookies, Web Storage makes it easier to control how information stored by one window is visible to another.
For example, a user might open two browser windows to buy airline tickets for two different flights. However, if the airline's Web application uses cookies to store its session state, information could "leak" from one transaction into the other, potentially causing the user to buy two tickets for the same flight without noticing. As applications become more capable of offline behaviors, such as storing values locally for later return to the server, the potential for this sort of information "leak" becomes more prevalent.
Web Storage also offers significantly more disk space than cookies. In Windows Internet Explorer, cookies can store only 4 kilobytes (KB) of data. This byte total can be one name/value pair of 4 KB, or it can be up to 20 name/value pairs that have a total size of 4 KB. By comparison, Web Storage provides roughly 10 megabytes (MB) for each storage area.
Functionally, client storage areas are quite different from cookies. Web Storage doesn't transmit values to the server with every request as cookies do, nor does the data in a local storage area ever expire. And unlike cookies, it is easy to access individual pieces of data using a standard interface that has growing support among browser vendors.
- window.sessionStorage
- window.localStorage
- The Storage Object
Session storage is designed for scenarios where the user is carrying out a single transaction. The sessionStorage attribute of the window object maintains key/value pairs for all pages loaded during the lifetime of a single tab (for the duration of the top-level browsing context). For example, a page might have a check box that the user selects to indicate that he wants insurance.
<label>
<input type="checkbox" onchange="sessionStorage.insurance = checked">
I want insurance on this trip.
</label>
A later page could then check, from script, whether the user had selected the check box.
if (sessionStorage.insurance) { ... }
The Storage object supports expando properties ('insurance' in the preceding example). If the property name does not exist, a key/value pair is automatically created to hold it. Note that key/value pairs are always stored as strings. Different data types such as numbers, Boolean values, and structured data must be converted to strings before persisting to a storage area.
After a value has been saved to sessionStorage, it can be retrieved by script running in another page in the same context. When another document is loaded, sessionStorage is initialized from memory for same-origin URLs. (See Security and Privacy section for more information.)
Note Although it is allowed by HTML5, Internet Explorer 8 does not resume sessionStorage after browser crash recovery.
The local storage mechanism spans multiple windows and persists beyond the current session. The localStorage attribute provides persistent storage areas for domains. It allows Web applications to store nearly 10 MB of user data, such as entire documents or a user's mailbox, on the client for performance reasons.
For example, a Web site can display a count of how many times the user has visited a page with the following script.
<p>
You have viewed this page
<span id="count">an untold number of</span>
time(s).
</p>
<script>
var storage = window.localStorage;
if (!storage.pageLoadCount) storage.pageLoadCount = 0;
storage.pageLoadCount = parseInt(storage.pageLoadCount, 10) + 1;
document.getElementById('count').innerHTML = storage.pageLoadCount;
</script>
Note Before incrementing pageLoadCount it must first be converted to a number with the parseInt Method (JScript 5.6).
Each domain and subdomain has its own separate local storage area. Domains can access the storage areas of subdomains, and subdomains can access the storage areas of parent domains. For example, localStorage['example.com'] is accessible to example.com and any of its subdomains. The subdomain localStorage['www.example.com'] is accessible to example.com, but not to other subdomains, such as mail.example.com.
The following properties and methods are supported by both session and local storage objects.
| Topic | Contents |
|---|---|
| clear | Removes all key/value pairs from the Web Storage area. |
| constructor | Returns a reference to the constructor of an object. |
| getItem | Retrieves the current value associated with the Web Storage key. |
| key | Retrieves the key at the specified index in the collection. |
| length | Retrieves the length of the key/value list. |
| remainingSpace | Retrieves the remaining number of UTF-16 characters allowed for the storage object. |
| removeItem | Deletes a key/value pair from the Web Storage collection. |
| setItem | Sets a key/value pair. |
Internet Explorer fires events when data in a storage area is updated, so that information can synchronized between multiple instances of the browser or tabs.
The following events are supported.
- onstorage
- onstoragecommit
The onstorage event is fired in a document when a storage area changes. All documents sharing the same session context, and those that are currently displaying a page from the same domain or subdomain where local storage is being committed, receive the event.
If the target document object is not currently active, Internet Explorer does not fire any events.
Internet Explorer uses XML files to store local storage. The onstoragecommit event fires when a local storage is written to disk.
The data stored in local storage is much more public than that stored in cookies, which can be limited to a certain path within a domain. Even picking a hard-to-guess key won't provide any privacy because the Storage object provides a way to enumerate them.
Here are some things to consider:
- Top-Level Browsing Context and Hostname
- Origin Determines Storage Limits
- Clearing the Storage Areas
Access to the session storage area is restricted by the top-level browsing context. In Internet Explorer, a new browsing context is created for every tab. Script running in one top-level browsing context has no access to storage created in another. Sites can add data to the session storage, and it will be accessible to any page from that hostname opened in the same window.
Important The port and protocol/scheme are not evaluated as a part of this check.
Disk quota limits are imposed against the domain of the page that sets the value, rather than the domain where the value is being set. This prevents malicious scripts from using up the storage quota of a related domain. It also prevents such scripts from using random subdomains to store unrestricted amounts of data.
Storage size is calculated as the total length of all key names and values, and a single storage area can contain up to 10 million bytes. The remainingSpace property is used to determine the available storage space.
Session state is released as soon as the last window to reference that data is closed. However, users can clear storage areas at any time by selecting Delete Browsing History from the Tools menu in Internet Explorer, selecting the Cookies check box, and clicking OK. This clears session and local storage areas for all domains that are not in the Favorites folder and resets the storage quotas in the registry. Clear the Preserve Favorite Site Data check box to delete all storage areas, regardless of source.
To delete key/value pairs from a storage list, iterate over the collection with removeItem or use clear to remove all items at once. Keep in mind that changes to a local storage area are saved to disk asynchronously.
Saving files locally using Web Storage
Building Offline Experiences with HTML5 AppCache and IndexedDB
Using Web Storage on the Client-Side
Writing a data-centric oriented web application using HTML5 local storage