search

remix-run / history

Manage session history with JavaScript
MIT License
8.29k stars 959 forks source link

SecurityError: The operation is insecure, saveState/readState in Firefox when cookies disabled #97

Closed dogosaur closed 8 years ago

dogosaur commented 8 years ago

Sorry if I'm doing anything wrong, I'm new to Github and also pretty new to Javascript...

SecurityError in saveState: window.sessionStorage.setItem

Also in readState: var json = window.sessionStorage.getItem

Seems similar to the issue here, but a different exception: https://github.com/rackt/history/issues/42

Is there any reason to leave the possibility of an unhandled exception at all? Can't we just warn and ignore? Is save/loadState a critical function? (I am using this from react-router and haven't yet got my head around it all.)

mjackson commented 8 years ago

I'm not able to duplicate this error.

firefox

Also, the MDN docs on sessionStorage don't mention anything about it not being available in Firefox' private browsing mode, but they do specifically mention Safari's.

Can you give me more details about your setup?

dogosaur commented 8 years ago

You are right, sorry! It actually seems it occurs when cookies are disabled in the browser, not the private browsing mode.

(In my case, through the "self destructing cookies" add-on, but it seems you can get the same effect when disabling cookies in the options.)

Also the same on Chrome.

mjackson commented 8 years ago

So, if we're not able to save state and the developer is relying on some state being present, they're going to wonder why their app is broken for some users but not for others. Is a warning enough in this case?

taion commented 8 years ago

I definitely don't think this is the kind of warning that can be safely suppressed in production.

mjackson commented 8 years ago

For a while now I've been thinking about possibly providing an alternate storage engine for DOM histories that leverages window.name to store data instead of window.sessionStorage. I wonder if that would work in Firefox with cookies disabled. Probably.

mjackson commented 8 years ago

This was addressed in #120, though I agree that we should probably do more than just warn. I'll open a separate issue for discussing that.