What are the security and privacy considerations when using IndexedDB?

Question

Ponu Maurya · Answer

When using IndexedDB, security and privacy are critical concerns—especially for apps storing sensitive user data. Here are the key considerations: 1. Same-Origin Policy Each origin (protocol + domain + port) has its own isolated IndexedDB.One site cannot access the IndexedDB data of another site.This prevents cross-site data leakage. 2. No Built-in Encryption Data in IndexedDB is not encrypted by default.If you're storing sensitive data (like tokens, passwords, PII): Use client-side encryption before storing.Use the Web Crypto API to encrypt/decrypt. 3. Storage Persistence Data is stored persistently (survives tab close, restart, etc.).But: Browsers may clear data if the device is low on storage (especially on mobile).You can request persistent storage: 4. No Access Control (Auth) IndexedDB does not have access control.Any JavaScript running in the same origin can access the DB.If you load third-party scripts, they could potentially access your DB if not sandboxed. Mitigation: Never expose IndexedDB to untrusted scripts. 5. Private/Incognito Mode IndexedDB is usually supported in incognito/private mode.However: Data is wiped after the session.Some browsers may disable or restrict its behavior. 6. Fingerprinting Risks IndexedDB can be used for tracking users: Storing unique IDsChecking if a DB or key exists to re-identify users Browser privacy tools (like Brave, Safari) may isolate or limit IndexedDB for this reason. 7. Storage Size Limits IndexedDB quotas vary: Usually 5–50MB per origin without user promptHigher on desktop with user interaction Exceeding limits can cause QuotaExceededError. Best Practices Summary Recommendation Why Use HTTPS Prevent man-in-the-middle attacks Encrypt sensitive data Protect user info if device is compromised Request persistent storage Ensure offline data survives Avoid untrusted scripts Prevent unauthorized DB access Use clear versioning strategy Avoid upgrade errors Be mindful of fingerprinting Respect user privacy

Recommendation	Why
Use HTTPS	Prevent man-in-the-middle attacks
Encrypt sensitive data	Protect user info if device is compromised
Request persistent storage	Ensure offline data survives
Avoid untrusted scripts	Prevent unauthorized DB access
Use clear versioning strategy	Avoid upgrade errors
Be mindful of fingerprinting	Respect user privacy

interview

What are the security and privacy considerations when using IndexedDB?

Can you answer this question?

1 Answers

1. Same-Origin Policy

2. No Built-in Encryption

3. Storage Persistence

4. No Access Control (Auth)

5. Private/Incognito Mode

6. Fingerprinting Risks

7. Storage Size Limits

Best Practices Summary