hotdoc / hotdoc_bootstrap_theme

1 stars 6 forks source link

Eliminate all cookie usage, replacing with localStorage (Web Storage API) #18

Closed ferdnyc closed 1 year ago

ferdnyc commented 1 year ago

Users are growing increasingly distrustful of cookies. Understandably so: As information that's sent back to the server with every web request, they've become the primary vector for user tracking and collection of sensitive personal information by online advertisers and information brokers.

Even when cookies are used in completely innocent ways, as they are in hotdoc, they remain guilty by association with more objectionable uses.

Fortunately, there's a better way: the browser Web Storage API, and specifically the window.localStorage() data store. Using localStorage(), a site can persist information in the user's browser for local access, without it being sent over the wire back to the remote server.

This PR replaces all use of cookies for data storage with calls to localStorage.setItem() and localStorage.getItem(). The selected language is stored as hotdoc.gi-language, and the style selection as hotdoc.style.

Caveats

No migration of values from the previous cookie storage is currently implemented, meaning that users' selections will be reset the first time they return to a site that's been upgraded from cookie-based persistence to localStorage(). However, that's at worst a minor inconvenience, and no different from the situation if they'd returned to the site after longer than 1 year's time. (The expiration time of the cookie data. localStorage() data does not expire, it will be retained indefinitely unless edited or deleted by the enduser.)

Implementation notes

As one of the commits in this PR notes, the onunload-driven updating of the selected stylesheet is still in the code (but converted from storing via cookies to using localStorage), however it's currently commented out. I can't see any reason it would be necessary with the new code, since updating the stored value is now the very first thing setActiveStyleSheet() does. (The localStorage API doesn't have the same overhead as cookie management, so there's no reason not to be aggressive about storage updates.) That should make any kind of onunload-driven updating redundant/unnecessary.

ferdnyc commented 1 year ago

@MathieuDuponchelle would you be able to take a look at this?

MathieuDuponchelle commented 1 year ago

@ferdnyc yes sorry I haven't had much time for maintaining duties lately, I will take a look tomorrow, promised

MathieuDuponchelle commented 1 year ago

Sorry @ferdnyc this is now conflicting, I'll be happy to merge once the conflicts are resolved :)

ferdnyc commented 1 year ago

@MathieuDuponchelle All set!

MathieuDuponchelle commented 1 year ago

Well that was fast, thanks !

ferdnyc commented 1 year ago

I just happened to be doomscrolling through Tumblr when the notification popped in, figured this was a better use of my time anyway. :grin:

MathieuDuponchelle commented 1 year ago

I just happened to be doomscrolling through Tumblr when the notification popped in, figured this was a better use of my time anyway. 😁

oh my poor soul, happy to break the cycle :)