3

We're storing some encrypted text in the session Window.sessionStorage for community portal, just to avoid multiple server call backs for different navigations.

Will it be flagged under any security vulnerabilities?

If so what would be the best and secured way of storing the data(which is not confidential though, and even we're encrypting it) in any session or cache

Also while im searching for session storage, have seen few storages from salesforce Platform Cache and Session Cache, any idea how these works with security review and are these are replaceable for window.sessionStorage?

Also any best practices for security review related to session storage could help us.

1
  • Why are you encrypting the data? Is the data sensitive information? Jul 4 '21 at 13:14
3

have seen few storages from salesforce Platform Cache and Session Cache, any idea how these works with security review and are these are replaceable for window.sessionStorage?

Platform Cache is not a replacement for your stated intention, which is to reduce server calls. It is a technology meant for Apex to reduce CPU usage by avoiding recalculating expensive algorithms every time you need the value in Apex. You need to call the server to access the cache. It's the server-side equivalent to window.sessionStorage.

If so what would be the best and secured way of storing the data(which is not confidential though, and even we're encrypting it) in any session or cache

If it's not confidential data, you don't need to worry about encrypting it while at rest on the client. Store it however you want.

Will it be flagged under any security vulnerabilities?

No, it's just non-privileged data that you're storing for later use. It'd be no different than storing data in a variable. Most users wouldn't know how to view or modify that data anyways, as they're not programmers, and someone with enough skill to hack the data would only be modifying their own local copy, so it's not a security vulnerability in any real sense.

Also any best practices for security review related to session storage could help us.

Don't store usernames, passwords, birthdates, encryption keys, or anything else considered even remotely sensitive in a client-side cache unless you have a very compelling reason. Commonly public data is perfectly fine to store the in the cache; if it's sent the browser, a user can easily read the data anyways if they have the skill to do so, so it's not exactly a secret, encrypted or not.

For actual secret data, read Secure Coding: Storing Secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.