Skip to content

Session storage key does not distinguish integrations sharing an object name #19

Description

@justadreamer

The session storage key is the object name alone, so two pages on one origin that share an object name but use different resource configurations or endpoints read each other's cached payload and property flags. One can complete from the other's response without running its own snippets or calling its own callback URL, leaving its client-evidence properties unresolved for the life of the tab. The default object name is fod, so this needs no unusual setup to hit.

Either include the callback URL's origin and path in the key, or document object-name uniqueness as a requirement for integrators.

If the key route is taken, exclude the query string: pipeline-java renders the page view's own query evidence into the callback URL, so including it would put the key back to changing on every page view.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions