HTML5 Web 数据库安全
我正在研究使用 HTML5 的离线 Web 应用程序解决方案。 该功能是我需要的一切，但存储的数据可以直接在浏览器中查询，因此完全不安全！
是否有办法加密/隐藏以使数据安全？
谢谢， D .
I'm looking into an offline web app solution using HTML5.
The functionality is everything I need BUT the data stored can be directly queried right in the browser and therefore completely unsecure!
Is there anyway to encrypt/hide so that the data is secure?
Thanks,
D.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您将数据存储在用户的计算机上，则无论您对数据进行多少加密，用户始终可以读取它[假设您没有使用哈希...]
敏感数据始终位于服务器端。
If you're storing data on the user's computer, the user can always read it, no matter how much you encrypt it [assuming you aren't using a hash...]
Sensitive data goes on the server-side, always.
HTML5 中的本地存储有两个问题 -
1、浏览器对 localStorage（或 sqllite 数据库）强制实施同域限制支持 safari），因此其他网站将无法访问您存储的数据。但是，请记住，如果您的网站存在 XSS 漏洞，则有可能窃取数据。
对于2，你无法阻止它。它就像一个cookie——用户可以选择查看/删除/修改它。
数据加密是可能的（请参阅http://farfarfar.com/scripts/encrypt/），但是无意义。您不能拥有单个全局密钥/密码 - 因为攻击者可以轻松地从 JavaScript 代码中找出密钥。使用用户输入的密码进行加密/解密是可能的，但客户端加密库还不够成熟或测试得不够好。可能有很多方法可以打破它。
因此，至少现在不要将敏感数据存储在 localStorage 中。
There are two concerns to local storage in HTML5 -
For 1, browsers enforce the same-domain restrictions to localStorage (or the sqllite database support that safari has), so other websites won't have access to the data that you store. However, do remember that if your site has XSS vulnerabilities, it would be possible to steal the data.
For 2, you can't prevent it. Its just like a cookie - the user can chose to view/delete/modify it.
Encryption of data is possible (see http://farfarfar.com/scripts/encrypt/), but pointless. You cannot have a single, global key/password - because an attacker can easily figure the key from javascript code. Using a user-entered password to encrypt/decrypt is possible, but client-side encryption libraries aren't mature or tested well enough. There are likely tons of way to break it.
So, for now atleast, don't store sensitive data in localStorage.
您还可以查看文章HTML5 SecureStore Porposal 的作者对这个问题的关注
You can also see an article on this concern by the author of the HTML5 SecureStore Porposal