Bug 199928 – sessionStorage/localStorage disconnected from persistent storage if accessed "too early"

• Status: NEW
• Component: WebKit Misc.

[Florian Schoppmann]

Consider the following code that writes to sessionStorage/localStorage and then immediately sets a new location with an origin different from the current one:

sessionStorage.setItem(key, value);
window.location.href = url;

Now assume that the site at `url` immediately redirects back. Upon redirect, however, sessionStorage.getItem(key) === null.

https://fschopp.github.io/safari-local-storage-bug/ is a test case that reliably shows the bug both with Safari 12.1.1 as well as with Safari on iOS 12.3.1. The test case works as expected in Chrome and Firefox; that is, in the browsers sessionStorage.getItem(key) returns the value that was previously written.

Background: I stumbled across the problem when attempting to store local state during OAuth authentication (as opposed to, say, encoding local state in the OAuth redirect URL).

[Florian Schoppmann]

I had a cursory look at various relevant places in the WebKit source code some weeks ago, but didn't find anything obvious. Just in case: Back then, I collected some findings and links in a GitHub issue. https://github.com/fschopp/project-planning-for-you-track/issues/1

[Florian Schoppmann]

It appears that the WebKit bug occurs if sessionStorage or localStorage are accessed “too early.” In that case, they appear disconnected (for both reads and writes) from the persistent storage, for the entire time the user stays on the current page.

A workaround is for the JavaScript code to wait before accessing the storage. I updated my test case at https://fschopp.github.io/safari-local-storage-bug/ so it demos both the bug (as before) and the workaround.

Interestingly, it appears Firefox used to have a similar problem.
https://stackoverflow.com/questions/13852209/localstorage-unreliable-in-firefox/13856156
(The workaround mentioned on StackOverflow -- accessing sessionStorage.length -- does not work for Safari, though.)

[Radar WebKit Bug Importer]

<rdar://problem/53375713>

[Sihui Liu]

Hi Florian,

Thank you for the report.

I think this is related to https://bugs.webkit.org/show_bug.cgi?id=195074, where session storage is lost when process is swapped on navigation to another domain.

I just tested your web page on macOS Mojave with system Safari 12.1, Safari Technology Preview Release 87 and Safari 13.0 beta. (Safari comes with its own WebKit framework). STP and beta load the page correctly, so this should be fixed.