Persistent local storage in iOS Safari issues

Question

I'm currently working on a web application which sits inside an iframe for security purposes (protecting user data) and is hosted on other websites. To keep session state for insecure data, we write some data to local storage for user functionality i.e., remembering the user's background colour we save "backgroundColour" as "red".

However I have run into the following two issues on iOS Safari which currently work on MacOS Safari and Chrome and internet Explorer 11.

Issue 1: local storage is not retained when I force quit iOS

1. The user navigates to the host website, www.host.com, which loads my iframe content from a different domain, www.example.com
2. The user then interacts with the iframe and saves their background colour preferences which I save to local storage.
3. The user then force quits Safari or navigates away and then force quits Safari.
4. Navigate back to the host website

Expected behaviour: The localStorage contains the backgroundColour property

Actual behaviour: The local storage is empty

Issue 2: using the iframe content on different sites doesn't utilise local storage

1. The user navigates to the host website, www.host.com, which loads my iframe content from a different domain, www.example.com
2. The user then interacts with the iframe and saves their background colour preferences which I save to local storage.
3. The user navigates to www.awesomesite.com which also has my iframe content from the domain in step 1, www.example.com

Expected behaviour: The local storage is retained between the different sites because the storage is against DNS of the iframe

Actual behaviour: The local storage is empty

Has anyone experienced this before? Are there any workarounds that people have found? Is this a bug in iOS Safari? Have I done something wrong?

Cheers

Solution

Issue 1 is Safari behavior and cannot be changed externally with code. Please open a feature request or bug report with Apple:

https://www.apple.com/feedback/safari.html

Issue 2: Unfortunately, the technique you are using "3rd party local storage" is a technique employed by tracking technologies. The recent privacy push has led all browsers to make more strict rules for 3rd party cookies, and other local storage. You will find that privacy settings will make your user experience inconsistent. You cannot expect your local storage to be reliable when you are a 3rd party.

SEE: Is there any workaround to set third party cookie in Iframe for safari?

AND

https://medium.com/@bluepnume/safaris-new-tracking-rules-and-enabling-cross-domain-data-storage-85241eea7483

AND

https://groups.google.com/forum/#!topic/mozilla.dev.platform/vm81cSx4teo

Comments

[Matt Rowles]

Good idea, I have raised this as an enhancement request with Apple. Thanks for the response on behalf of the team :)

[Wannes]

@MattRowles, did you find any solution to not clear the localStorage from the iframe?