I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage
to do it. Here's the plan as I see it.
- User enters sensitive data into form, and submits.
- Server encrypts data via AES-256 with a strong key that is kept in private source control.
- Server responds, providing encrypted data to rendered page.
- Page runs javascript to save encrypted data to
localStorage
Later...
- User visits a page that uses javascript to fetch encrypted data from
localStorage
and sends it to the server. - Server decrypts encrypted data, gaining access to sensitive information for that request.
My thinking is that that allows either the client or server to compromised, and things stay secure. If the client is compromised, then the hacker can read only an encrypted string they do not have the key to decrypt. If the server database is compromised, the data is simply not stored there so it obviously can't be accessed by the hacker.
(Obviously some types of server hacking could read sensitive data as it's coming in initially, but such a hack would work whether client storing it or not, so that doesn't apply to this discussion. Also client hacks that log keys and whatnot would still work, I'm simply talking about data storage getting compromised on either side here)
But I'm no security expert, so I am wondering if my plan has any holes in it? Any glaring security vulnerabilities I am missing here?