World Wide Web Consortium Defines API for Web Storage

By Corentin Béchade, Redactor, StorageNewsletter.com

The Web Application Working Group of the World Wide Web Consortium (W3C),
the international standard organization, decided on the specification
for persistent client-side data storage. It’s called Web Storage and also named DOM storage (document object model.)

The API defines how structured data should be stored on the client
side. The standard was first developed by Ian Hickson, a Google
employee and author of the Acid2 and Acid3 test and specification
editor, in the Web
Hypertext
Application
Technology
Working
Group.

The organism defines the new specification as "similar to HTTP
session cookies". It’s used to store relevant data on the
client side for a better experiences with web application.

They
introduced two related mechanism to perform this action.

First the sessionStorage IDL attribute can be use by website
to add data to the session storage, allowing it to be read by any
page from the same website. For example, with cookies, if a user
wants to buy a plane ticket and uses multiple windows to compare
prices, as the user click through on both windows the ticket
currently being purchased can "leak" from one window to another,
causing the user to buy two tickets at the same time without really
noticing. With sessionStorage, each window would have its own copy of
the data. Nevertheless this particular attribute do not last beyond the
current session.

The localStorage IDL on the other hand, can be used to store
long-lasting user data that lasts beyond the current session and is
available across multiple windows. It would allow web application to
store megabytes of user data on the client side for performance
reason. A site could potentially count how many times a user visited
a particular page by looking into the user stored data. Each site can
maintain its own separate storage area. An ‘arbitrary limit’ of 5MB per origin is recommended but the user can grant more
space if needed. And each browser can set its default limit from 5MB
to 25MB.

The standard is already supported by most web browsers. Internet
Explorer (8 and beyond), Firefox, Opera, Safari and Chrome have implemented the functionality.

On the security
side, data can be destroyed after a certain period of time and
the use of TLS protocol can prevent domain spoofing.