[whatwg] Some likeness of DOM Session scope --> Steal Flash's SharedObject Syntax
ian at hixie.ch
Wed Sep 7 15:14:24 PDT 2005
On Fri, 22 Apr 2005, Brad Neuberg wrote:
> Flash MX has a scriptable object named SharedObject that can contain far
> more application state than a normal cookie can, but for Flash movies.
> Perhaps this is a good concept to steal from Flash? They've thought
> through the API pretty well. One thing that is unique about these is
> that they can store binary, so that you can actually serialize the state
> your cookie, making programming in Flash very productive. You can also
> store images, sounds, video etc., leading to very fast startup time for
> apps that use these.
Do you think the API now in the WHATWG spec:
...is good enough? I tried to make it as usable as the Flash API.
I didn't include any specifically binary-related storage features; I
wasn't really sure what the use case was (in terms of HTML5, I mean), and
couldn't really see how you would have binary data to store in the first
place in an HTML document. (Things like images would end up in the
browser's cache, so wouldn't be an issue.)
> In terms of security, we should be careful that these can't be used as a
> vector to attack the local system, either through a buffer overflow
> attack or a way to get a binary image onto a machine that can then be
Indeed; I included a detailed security subsection on the topic of issues
with this feature. Please let me know if you see anything I missed.
> One note: when a user clears their cookies we should also clear out
> these SharedObjects, probably presenting them to the user as
> super-charged cookies, to prevent a similar security bug that affected
> Flash. There is a sneaky adware attack called PIE that stores cookies
> into a Flash's SharedObjects, pulling them back out if a user clears
> their cookies since Flash didn't hook clearing the SharedObjects into
> clearing the cookies in the browser.
Indeed. I tried to cover this. Let me know if the mention of this is clear
Ian Hickson U+1047E )\._.,--....,'``. fL
http://ln.hixie.ch/ U+263A /, _.. \ _\ ;`._ ,.
Things that are impossible just take longer. `._.-(,_..'--(,_..'`-.;.'
More information about the whatwg