[frontend] 240 localStorage/sessionStorage writes with no size limits or expiry #794

New issue

Open

opened 2026-06-03 00:40:55 +02:00 by sleepy · 0 comments

sleepy commented

2026-06-03 00:40:55 +02:00

Owner

Finding

Frontend JS makes 240 localStorage/sessionStorage calls across all files. There is no centralized storage management — each module writes independently with no TTL, eviction policy, or size monitoring.

Impact

No coordination between modules on storage keys — potential for key collisions
localStorage has a ~5MB limit per origin; with 240+ writes across features, hitting the quota is realistic
No error handling for storage quota exceeded (throws QuotaExceededError)
Stale data persists forever — no expiry mechanism
In a multi-user shared-browser scenario, one user's cached data leaks to the next

Recommendation

Create a centralized storage helper in ui.js that handles quota errors gracefully
Add TTL support for cached data
Namespace all keys by module/feature to prevent collisions
Add try/catch around all localStorage writes (or use the centralized helper)

## Finding Frontend JS makes **240 localStorage/sessionStorage** calls across all files. There is no centralized storage management — each module writes independently with no TTL, eviction policy, or size monitoring. ## Impact - No coordination between modules on storage keys — potential for key collisions - localStorage has a ~5MB limit per origin; with 240+ writes across features, hitting the quota is realistic - No error handling for storage quota exceeded (throws QuotaExceededError) - Stale data persists forever — no expiry mechanism - In a multi-user shared-browser scenario, one user's cached data leaks to the next ## Recommendation 1. Create a centralized storage helper in ui.js that handles quota errors gracefully 2. Add TTL support for cached data 3. Namespace all keys by module/feature to prevent collisions 4. Add try/catch around all localStorage writes (or use the centralized helper)