ContributingWeb client
What the browser stores
The session is a cookie that the page cannot read. localStorage has only the preferences of the UI.
The session is the cookie. The page cannot read it.
1 / 2
No secret in localStorage
The app keeps no token and no secret in localStorage. The session is the session cookie, and the page cannot read it.
The app stores only the preferences of the UI, under the key ferry.ui:
- the theme
- the rail
- the options of the log viewer
The theme before the first paint
public/theme-init.js applies the saved theme before the first paint.
It is an external file, not a script in the HTML. Thus the app works with a strict Content Security Policy: script-src 'self'.