What are the security and privacy considerations when using IndexedDB?

Question

Ponu Maurya · Answer

When using IndexedDB, security and privacy are critical concerns—especially for apps storing sensitive user data. Here are the key considerations:
1. Same-Origin Policy
Each origin (protocol + domain + port) has its own isolated IndexedDB.One site cannot access the IndexedDB data of another site.This prevents cross-site data leakage.
2. No Built-in Encryption
Data in IndexedDB is not encrypted by default.If you're storing sensitive data (like tokens, passwords, PII):
Use client-side encryption before storing.Use the 
Web Crypto API to encrypt/decrypt.
// Encrypt data before storing (example only, not production-safe)
const encoder = new TextEncoder();
const data = encoder.encode("secret message");
// Use subtleCrypto for real encryption
3. Storage Persistence
Data is stored persistently (survives tab close, restart, etc.).But:
Browsers may clear data if the device is low on storage (especially on mobile).You can request persistent storage:
navigator.storage.persist().then(granted =andgt; {
    console.log(granted ? "Persistent storage granted" : "Not granted");
});
4. No Access Control (Auth)
IndexedDB does not have access control.Any JavaScript running in the same origin can access the DB.If you load third-party scripts, they could potentially access your DB if not sandboxed.
Mitigation: Never expose IndexedDB to untrusted scripts.
5. Private/Incognito Mode
IndexedDB is usually supported in incognito/private mode.However:
Data is wiped after the session.Some browsers may disable or restrict its behavior.
6. Fingerprinting Risks
IndexedDB can be used for tracking users:
Storing unique IDsChecking if a DB or key exists to re-identify users
Browser privacy tools (like Brave, Safari) may isolate or limit IndexedDB for this reason.
7. Storage Size Limits
IndexedDB quotas vary:
Usually 5–50MB per origin without user promptHigher on desktop with user interaction
Exceeding limits can cause QuotaExceededError.
Best Practices Summary
Recommendation
Why
Use HTTPS
Prevent man-in-the-middle attacks
Encrypt sensitive data
Protect user info if device is compromised
Request persistent storage
Ensure offline data survives
Avoid untrusted scripts
Prevent unauthorized DB access
Use clear versioning strategy
Avoid upgrade errors
Be mindful of fingerprinting
Respect user privacy

interview

What are the security and privacy considerations when using IndexedDB?

Ponu Maurya

Can you answer this question?

1 Answers

1. Same-Origin Policy

2. No Built-in Encryption

3. Storage Persistence

4. No Access Control (Auth)

5. Private/Incognito Mode

6. Fingerprinting Risks

7. Storage Size Limits

Best Practices Summary

Liked By

Recommendation	Why
Use HTTPS	Prevent man-in-the-middle attacks
Encrypt sensitive data	Protect user info if device is compromised
Request persistent storage	Ensure offline data survives
Avoid untrusted scripts	Prevent unauthorized DB access
Use clear versioning strategy	Avoid upgrade errors
Be mindful of fingerprinting	Respect user privacy