Why LocalStorage Stays Undeleted? - html

I know this was asked before but this is what I'm experiencing -
I'm working on a Chrome extension that needs to persist some data and I'm using localStorage for that . When I go to Settings->Tools->Clear Browsing Data and check everything (including 'since the beginning of time') , I would expect the localStorage of my background page to clear .
However everything stays put. The localstorage wasn't deleted!
It's not that I don't like that behavior , it's actually pretty great for my app , but is this normal ? Shouldn't localStorage delete once the user tries to clear everything , just like cookies should delete?
P.S
I found this nice blog that asks and tries to answer the same question :
http://sharonminsuk.com/blog/2011/03/21/clearing-cache-has-no-effect-on-html5-localstorage-or-sessionstorage/
Seems like the behavior changes from browser to browser . The behavior I talked about happens on Chrome 28.0.1500.71 m

This bug is not normal behavior. ( to answer your question )
I'm calling this a bug because someone might be using a computer at a library with some type of locally hosted application. There is a clear expectation that data is not retained in any way under a purge called "beginning of time"
Firefox purges localStorage data when you clear all browser data. It does this if the file is stored locally or hosted on a web domain.
Chrome purges localStorage data only if you code is hosted on a domain.
I made a video of this bug..
https://youtu.be/CgojKg4v7X0
Save this URL with HTML/JS a local drive to reproduce the bug...
https://html5dataprivacy.github.io/
steps:
- load a local web page containing javascript HTML5 storage code
interact with the page that stores your data in a way that changes the data
clear everything in history until the beginning of time
give the keyboard and mouse to another user in the library or public cafe...
result: That javascript storage is retained , another person can see your data...
expected result: The data is purged for the new person at the keyboard
notes: This bug does not exist on Firefox current version as of April 19th, 2017. Does not fail if chrome is working off a hosted domain
Workaround: After you clear things to the beginning of time you must open up the console and type "localStorage.clear()"
ps: please be kind. This is my first attempt to answer on StackOverFlow :)

Related

How to remove all data chrome stores for a url?

TL;DR I'd like to make chrome's state as though it had never, ever visited a certain url before.
Longer version:
I'm working on an application, and have a complicated problem regarding XSS vulnerabilities, which could be caused by the browser 'remembering' something about a previous session which could cause nonces to not match. The upshot is that I need to be absolutely sure that when I visit the app url that chrome hasn't 'remembered' anything about it from any previous session(s).
Here's what I've tried:
Firstly, visiting: chrome://settings/cookies/detail?site=example.com and deleting all the cookies
Secondly, visiting: chrome://settings/clearBrowserData and deleting everything (unfortunately, this doesn't seem to be possible for one url at a time?)
I can prove that chrome has not completely 'forgotten' the site. The proof is complicated, but basically if I place a different app (with different flavicon) at the url, visit the url, then close out that tab, then complete the steps above to clear browser data and cookies (at this point chrome should have forgotten everything). Yet when I put a different app at the same url and visit the url, chrome uses the old app's flavicon, which (I think) proves that it hasn't completely forgotten everything it knew about the url!
So, that's the long version. But, the TL;DR is to simply make it as though chrome had never visited a site (preferably without altering data stored for other sites, or doing anything extreme like completely uninstalling/reinstalling)
A third attempt
To empty cache and hard reload, press cmd + opt + j to bring up the developer console, then right click on refresh and select 'Empty Cache and Hard Reload'. Yet the old flavicon still remains, indicating that not all info from that site was removed.
After about 2 hours, I figured the following techniques to try to remove the flavicon, but even after all of the following steps, as the flavicon from a previous app still remains in Chrome's 'memory'!
Do the first two steps from the question:
visit: chrome://settings/cookies/detail?site=example.com and delete all the cookies (replace example.com with the url in question)
visit: chrome://settings/clearBrowserData and deleting everything (would be great to know how to do this for a single site)
Right click on the tiny icon to the immediate left of the url (it will be a lock if using https, or the letter 'i' if using http).
Go into each of categories listed (e.g. 'Cookies', 'Site Settings' etc) and delete them all
Note
I didn't find a solution for removing all data from chrome, however, I found you can start a completely isolated chrome session with these instructions

Application Cache - HTML 5

In one of the online documents that talks about appcache for HTML5, it indicates that the cached files get updated once an offline user reconnects. I checked the original HTML5 appcache definition by W3, and I am not able to find anything that supports this statement.
Does anyone know if this is to be true?
Thanks in advance
MDN says the following, although if you scroll up on that page it says it's being deprecated.
If an application cache exists, the browser loads the document and its associated resources directly from the cache, without accessing the network. This speeds up the document load time.
The browser then checks to see if the cache manifest has been updated on the server.
If the cache manifest has been updated, the browser downloads a new version of the manifest and the resources listed in the manifest. This is done in the background and does not affect performance significantly.
And logic tells me that it would also depend on the app you're using, server you're trying to connect to and any special settings it might have, how long your browser keeps it's history, what it keeps, and if you saved the page to view offline - whether or not you have all the code/images saved in the right location(s).
Example:
Imagine you saved a page to view offline, and that page has a JS event handler that ran a while loop that did an ajax request every n seconds to do something, like make a number on a page change as long as you were online... As long as the loop is running, you suddenly connect to the internet, and it makes the request to the proper url with the right arguments, then it should go through, even though the url in your browser might say something like file:///C:/Users/you/Desktop/....
I've done this before, even though my url was like the one above. One time I was using braintree's drop-in javascript to a website, and using it's api on my backend. Trying to load the page when offline = Nothing. Online = Updated the spot on the page just fine when I had the required arguments, and it was pointing to the right url. If I got offline again, I could refresh the page, see the same images loaded in the <div>, but I couldn't send any data with it.

open an URL upon my extension has been installed or uninstalled

As for open an URL upon my extension has been uninstalled, I found the easiest way to do is using chrome.runtime.setUninstallURL, (1) any other good ways?
As for open an URL upon my extension has been first time installed, I don't find something like chrome.runtime.setInstallURL, I implemented the feature with
chrome.runtime.onInstalled.addListener(function(details){
if (details.reason=="install"){chrome.tabs.create({ url: homePage});}
})
I saw AdBlock opens its options page upon first time installed, but it doesn't even used chrome.runtime.onInstalled, its source code is so much complicated , I cannot figure out how it implement the feature ,(2) how it do it ? any other ways to open an URL or its options page upon the extension has been first time installed?
(3) what are the common ways to do something when an extension has been installed or uninstalled?
SetUninstallURL seems to be specifically designed for your task, so it's certainly the right way.
Regarding the installation page, not sure how AdBlock does it, but if you have a persistent background page, one of the simpler ways would be to show the page on every launch if a certain localStorage key is not set.
// background.html startup, for example DOMContentLoaded handler
if ( !localStorage.getItem('intro_shown') ) {
localStorage.setItem('intro_shown', true);
showIntroPage();
}
Local storage of the extension's background page will be persistent, apart from several corner cases (incognito mode in FF, etc).
Upd by Makyen:
chrome.storage seems to be a much better option specifically designed for extension storage needs. It could also be automatically synced with Chrome sync (using chrome.storage.sync)

SSRS URLs having issues

A little background info...
By far and large the URLs worked perfectly fine. Occasionally either my machine, or the server itself couldn't access the Web Service URL or the Report Manager URL. For the server a restart fixed this, for me I had to reset my winsock which never worked and ended up System Restoring to a working date.
When I say couldn't access I mean getting the "This Page Cannot Be Displayed" message, or the "Please turn on TLS 1.0 etc etc" message.
The last few days the issue is now widespread. Everyone was having issues gettings to the URLs even the server. I figured it may have been some windows updates causing issues so I removed all the updates around the timeframe in which it started and tested and got nothing.
Came back the next day (today) and same issue except the only way to access it is through a hyperlink thats clicked or copy/pasted.
The issue:
If you manually type the URL it will not work. You have to copy and paste the hyperlink from a working page. I used a link to a rendered report and deleted back to /ReportServer and it pulls up the directory. I've never seen something like this happen before.
The Solution:
Apparently you have to type in www. as well
I was so use to skipping that for most pages.
https://analytics.domain.com/ReportServer = fail
https://www.analytics.domain.com/ReportServer = win

Offline iOS web app: loads my manifest, but doesn't work offline

I'm writing a web app to be used offline on iOS. I've created a manifest, am serving it up as text/cache-manifest, and it usually works fine, when running inside Safari.
If I add it as an app to my home screen, then turn on Airplane mode, it can't open the app at all -- I get an error and it offers to close the app. (I thought this was the entire purpose of an offline app!)
When I load the app a first time when online, I can see in my logs that it's requesting every page listed in the manifest.
If I turn off Airplane mode, and load the app, I can see the first file it's requesting is my main.html file (which is both listed in the manifest, and has the manifest=... attribute). It then requests the manifest, and all my other files, getting 200's for all (and 304's for anything requested a second time during this load).
When I load the page in Chrome, and click around, the logs show the only thing it's trying to reach on the server is "/favicon.ico" (which is a 404, and which I don't think iOS Safari tries to load, anyway). All of the files listed in the manifest are valid and served without error.
The Chrome inspector lists, under "APPLICATION CACHE", all the cached files I've listed which I expect. The entire set of files is about 50 KB, way under any limit on offline resources that I've found.
Is this supposed to work, i.e., am I supposed to be able to create an offline iOS app using only HTML/CSS/JS? And where do I go about figuring out why it's failing to work offline?
(Related but doesn't sound quite the same to me, since it's about Safari and not a standalone app: "Can't get a web app to work offline on iPod")
I confirm that name 'cache.manifest' solved the offline caching problem in IOS 4.3. Other name simply did not work.
I found debugging HTML5 offline apps to be a pain. I found the code from this article helped me figure out what was wrong with my app:
http://jonathanstark.com/blog/2009/09/27/debugging-html-5-offline-application-cache/
Debugging HTML 5 Offline Application Cache
by Jonathan Stark
If you are looking to provide offline access to your web app, the Offline Application Cache available in HTML5 is killer. However, it’s a giant PITA to debug, especially if you’re still trying to get your head around it.
If you are struggling with the cache manifest, add the following JavaScript to your main HTML page and view the output in the console using Firebug in Firefox or Debug > Show Error Console in Safari.
If you have any questions, PLMK in the comments.
HTH,
j
var cacheStatusValues = [];
cacheStatusValues[0] = 'uncached';
cacheStatusValues[1] = 'idle';
cacheStatusValues[2] = 'checking';
cacheStatusValues[3] = 'downloading';
cacheStatusValues[4] = 'updateready';
cacheStatusValues[5] = 'obsolete';
var cache = window.applicationCache;
cache.addEventListener('cached', logEvent, false);
cache.addEventListener('checking', logEvent, false);
cache.addEventListener('downloading', logEvent, false);
cache.addEventListener('error', logEvent, false);
cache.addEventListener('noupdate', logEvent, false);
cache.addEventListener('obsolete', logEvent, false);
cache.addEventListener('progress', logEvent, false);
cache.addEventListener('updateready', logEvent, false);
function logEvent(e) {
var online, status, type, message;
online = (navigator.onLine) ? 'yes' : 'no';
status = cacheStatusValues[cache.status];
type = e.type;
message = 'online: ' + online;
message+= ', event: ' + type;
message+= ', status: ' + status;
if (type == 'error' && navigator.onLine) {
message+= ' (prolly a syntax error in manifest)';
}
console.log(message);
}
window.applicationCache.addEventListener(
'updateready',
function(){
window.applicationCache.swapCache();
console.log('swap cache has been called');
},
false
);
setInterval(function(){cache.update()}, 10000);
Sometimes an application cache group gets into a bad state in MobileSafari — it downloads every item in the cache and then fires a generic cache error event at the end. An application cache group, as per the spec, is based on the absolute URL of the manifest. I've found that when this error occurs, changing the path to the manifest (eg, cache2.manifest, etc) gives you a fresh cache group and circumvents the problem. I can vouch that all of our web apps work offline in full-screen with 4.2 and 4.3.
No offline web app (as of iOS 4.2) can run without an internet connection (which means Airplane mode, too) when using <meta name="apple-mobile-web-app-capable" content="yes" /> in the html head section. I have verified this with every example I've seen and the ones that use Safari to render the site work fine, but when you throw in that meta tag, it won't work. Try your app without it and you'll see what I mean.
I have found that clearing the Safari cache after enabling Airplane mode to be an effective way of testing whether the app is really functioning offline.
I have sometimes been fooled into thinking that the application cache was working when it wasn't.
I had struggled with this iOS 4.3 "no offline cache" problem since I updated my iPad to 4.3.1 from 4.2. I saw in another post in this site that it was working again in 4.3.2. So I updated by iPad again, now to iOS 4.3.3. But still couldn't get the offline caching to work until I renamed my manifest file to "cache.manifest". Then the caching started working again and I could run my HTML5 offline app from the Home Screen. I did not need to put the favicon.ico in to the cache manifest. And I also had full screen going (setting the "apple-mobile-web-app-capable" to "yes").
I have several working offline and on/offline web apps.
When I turn off airport mode, I get a request for the manifest and some other files.
I don't get requests for images, JavaScript, CSS or cached AJAX files.
If you see requests for your resources, IOS doesn't have them cached.
Safari in general is more picky with manifests.
I suggest you try Safari on your computer.
I have run into the same problem today on iOS 4.3. I was able to fix the problem by adding a favicon.ico file and also adding it to the manifest.
I've written an offline app that still seems to work in 4.2 and 4.2.1; the post is a little dusty, but the code still runs:
http://kentbrewster.com/backchannel/
Remy Sharp has a newer post with code that also works, here:
http://remysharp.com/2011/01/31/simple-offline-application/
His app:
http://rem.im/boggle/
After days of messing with getting offline web apps to work on an iPhone/iPod Touch using the Webserver's HTTP authentication, I discovered these useful nuggets:
Make sure Safari is at the URL root of the web app when tapping "Add to Home Screen". I used jQuery Mobile and was sometimes adding the link with"/#pageId". Caused trouble.
Run your Ajax calls in serial. This might only be important if your web app is using HTTP authentication, but my app was firing a whole slew of Ajax calls on page load in parallel and it caused the app to hang on the "apple-touch-startup-image".
Ajax calls are "successful" when offline (at least using Prototype.js). Test for an actual piece of data in the Ajax response, not just on the HTTP status. I used this to test for displaying cached (SQL) or live data.
In the manifest use "NETWORK:\n*\n". From what I could muster, this is a catch-all statement for anything not explicit in the "CACHE:" section. Use Chrome to make sure your manifest is correct. Look at Chrome's console for errors.
Not directly related, but tripped me up for a bit, openDatabase.transaction() calls are ASYNCHRONOUS! Meaning, the line of JS code after transaction (execute(), error(), success()) will execute BEFORE the success() function.
Good luck!
I found this solution that seemed to work for me, since I also ran into this problem during my development. This fix has worked fine for me so far and also for other people that I've asked to test it with, and I'm able to get it running offline (in airplane mode) and off the home screen after caching and whatnot. I've written a post about it on my site:
http://www.offlinewebapp.com/solved-apple-mobile-web-app-capable-manifest-error/
Delete your current web app icon on the home screen.
Go to settings and clear your Safari browser cache.
Double tap your home button to open the multitasking bar. Find the Safari one, hold your
finger down on it, and exit it.
Please let me know if this works for you also! Good luck!
I've written an app and it works fine through the mobile browser, but when adding the desktop... Doesnt work. I guess apple have given up on IOS4 and all efforts are now on OS5. Shame :(
I have one potential workaround for this - it seems a bit crazy, but here goes... I work with the cache.manifest and full screen apps a lot (here's a test if you need: http://www.mrspeaker.net/2010/07/12/argy-bargy/ - add to home screen then turn on flight mode and it launches - at least, as of iOS 4.2.1)
One weird thing I found is that sometimes it seems that some kind of "meta" information in files can mess them up from being cached - Have you ever noticed that in bash that if you do a "ls" some files (depending on your colour settings) are highlighted for no apparent reason? Files can have meta data that the operating system (I think) adds automagically - and there are ways to remove it... I can't remember why but here's some more details: Strip metadata from files in Snow Leopard
After tearing my hair out one day - and refusing to give up because I knew it SHOULD have worked... Chrome was saying it loaded all the files, but ended with a generic error. In the end I recreated the project structure with blank files and copy/pasted the contents over. It worked - started caching as it was supposed to!
When I looked at the files I noticed there was some meta info. I tried scrubbing this info and the original project worked again. I'm not sure this was the reason it worked again - perhaps it was just a coincidence.
Because it worked, I didn't think too much about it. The same problem happened again some months later and the copy/paste trick worked again. I was busy, so I didn't investigate further - but vowed I would get to the bottom of it the next time it happened.... but I haven't had to yet.
Phew. Anyway, glad I got to write that down somewhere...
[UPDATE: months and months later - I've not been able to reproduce this, so I don't think it's the metadata]