在会话/历史记录中存储用户数据是否安全？reactjs

Question

I took over this react application from an old developer, and I'm not super familiar with the way react works, but I never, in my life, have stored user's data in the history of the session. I notice he is doing just that, which freaks me out a bit:

const {
        history,
      } = this.props

      AuthorizationHome.doCreateUserWithEmailAndPassword(email, passwordOne)
        .then((authUser) => facades.userFacade().doCreateUser(authUser.user.uid, email, name, companyName))
        .then(() => {
          history.push(routes.HOME)
        })

is it actually safe to be doing this, or should I be storing in a DB and querying the data each time it's needed? I've always just either stored the user's data in the DB and queried it through my server-side code, or passed the data to my backend and manipulated it safely through there. please let me know!

Answer 1

It's based the type project your working on. If it's banking or it deals with any sensitive data and public usage application please avoid saving passwords in the on page login. It's better to user authentication session based on the project requirement.

Answer 2

Yes this data stays persistent as long as the page is not navigated or routed to same page with other data.

Answer 3

No it isn't safe, as if someone gets access of the client's computurer, they could retrieve the credentials and possibly have lifetime access to their account. Even with encryption, it isn't good to store username and password locally.

What you could do is implement JWT with short-lived tokens then encrypt them and store them locally (or use cookie based jwts but beware of csrf exploits). That way, if a client's tokens were stolen, the tokens could expire after a while, or if you detect they have been comprimised, revoke the tokens without having the client change their password.

You could also ask the user for a pin to use to encrypt and store their credentials locally, then when they open a new page/session, ask them for it to decrypt the stored data. I would advice against this, since the client can use simple pins such as 1-2-3-4 and instead of having them use longer pins/codes, just have them directly re-enter their passwords