It's not cookies. It can't be used to track you across sites the way that a cookie can, as all the embedding site needs to do is ping the site the cookie is for, and it's done. How do multiple sites access the same localStorage?
I support this behavior, but I wish it allowed users to opt-out per domain or something. The current behavior breaks localStorage on HTML5 games on itch.io (for iPad users, mostly) and there’s no real workaround (other than asking users to disable the setting entirely—something I don’t want them to do). It’s not even possible to detect this case and warn users, so they just think the games are broken…
Cookies can't really track you across sites reliably these days either. And in just the next couple years it will be almost entirely disabled by default in all major browsers
Is that really how httpOnly cookies work though? That and cross-origin is supposed to solve that, but I might not be aware of the work-around you're referring to. Did a search that turned up nothing, do you have a source?
I can't try myself right now. But last time I checked it's not at all that easy. What am I missing?
Comments
It's not cookies. It can't be used to track you across sites the way that a cookie can, as all the embedding site needs to do is ping the site the cookie is for, and it's done. How do multiple sites access the same localStorage?
With an iframe. Although Safari already has protections in place against this scenario: https://webkit.org/tracking-prevention/#partitioned-third-pa...
I support this behavior, but I wish it allowed users to opt-out per domain or something. The current behavior breaks localStorage on HTML5 games on itch.io (for iPad users, mostly) and there’s no real workaround (other than asking users to disable the setting entirely—something I don’t want them to do). It’s not even possible to detect this case and warn users, so they just think the games are broken…
Cookies can't really track you across sites reliably these days either. And in just the next couple years it will be almost entirely disabled by default in all major browsers
Is that really how httpOnly cookies work though? That and cross-origin is supposed to solve that, but I might not be aware of the work-around you're referring to. Did a search that turned up nothing, do you have a source?
I can't try myself right now. But last time I checked it's not at all that easy. What am I missing?
Well, no, but you wouldn't set httpOnly if you wanted to do that