对于针对移动浏览器的 Web 应用程序，我是否应该使用 localStorage 而不是 cookie？
我正在构建一个基于位置的网络应用程序，主要在移动浏览器上运行。它将使用 HTML5、javascript 和 PHP 进行编码。我希望尽可能不频繁地提示用户登录。我希望他们登录（通过 PHP），然后保持登录状态 x 时间。
我知道如何使用 cookie 执行此操作，但我一直在尝试使用 HTML5 localStorage。如果我使用 localStorage，我必须使用 javascript 进行所有验证并通过 Ajax 将其发送到 PHP。当我思考如何完成此操作时，我想知道使用 localStorage 是否真的值得。据我了解，它比cookie更安全，因为数据不是随每个HTTP请求一起传输的，并且不能跨域访问。但是像 iOS 和 Android 这样的现代浏览器难道不会阻止跨域访问 cookie 吗？
使用 localStorage 是不是让自己变得更难了？在这种情况下，选择 localStorage 而不是 cookie 的原因是什么？
I'm building a location-based web app that will run primarily on mobile browsers. It will be coded with HTML5, javascript, and PHP. I'd like the user to have to be prompted to login as infrequently as practical. I'd like them to login (via PHP) and then stayed logged in for x amount of time.
I know how to do this with cookies, but I've been experimenting with HTML5 localStorage. If I use localStorage, I have to do all the validation with javascript and send it to PHP via Ajax. As I'm thinking through how to get this done, I wonder if using localStorage is really worth it. From what I understand, it's more secure than cookies because the data is not transmitted with every HTTP request, and it can't be accessed cross-domain. But don't modern browsers, like iOS and Android, prevent cross-domain access to cookies?
Am I just making it harder on myself by using localStorage? What are the reasons to choose localStorage over cookies in a case like this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Cookies和localStorage有两种不同的用途，主要是cookies是供服务器端读取的，而localStorage是供客户端slide读取的。
如果您的客户端需要此数据，那么可以使用 localStorage（您可以通过不为每个 HTTP 请求发送 cookie [在标头中] 来节省带宽）。但如果您不这样做，那么就坚持使用 cookie。如果您所做的只是让服务器端访问此数据，那么发出额外的 HTTP 请求（通过 ajax）来向服务器发送 cookie 就有点矫枉过正了。
Cookies and localStorage have two different uses, mainly cookies are for reading by the server side, and localStorage is for reading by the client slide.
If your client side needs this data, then yes, use localStorage(you'll save bandwidth by not sending the cookies for every HTTP request[in the headers]). However if you are not, then just stick to using cookies. Making additional HTTP requests(via ajax) to send the server the cookies is a little overkill if all you are doing is having the server side access this data.