currently we're working on a small application where we store a bunch of JSON data coming from a JS-based graphing editor (think of a spiced-up version of this) in a Rails-based backend. We want to allow users to store the data encrypted (AES, RSA, whatever), where we as the application maintainers have no possibility of decrypting what's lying in our DB - given a strong password of course. There's no user account management, nothing. People are only able to create and edit their graphs via a secret link, nothing more nothing less.

The password would then be needed to encrypt / decrypt the graph coming and going to the DB before editing or saving the current state. Now, the conceptual questions we're facing right now are the following:

  1. Do we store the password throughout the session? If not the user would have to enter the password every time he refreshes the browser or wants to save the current state of his graph into the DB. Uncomfortable...

  2. If - from a software engineering perspective - this is applicable: Where does this kind of information gets stored in general? What options apart from cookies do we have?

  3. If so - would we have to store the plain password or is there a way to somehow encrypt the password so that in case of a stolen cookie an attacker would face a more difficult game getting the password?

  • Have you considered sessionStorage? My understanding is that that and localStorage do not use cookies, so would be viable for session-specific storage. It would not prevent malicious scripts accidentally loaded by the users on that domain from accessing the data, though. – JAB Mar 21 '18 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.