Hacker News Reader

If I try to host a javascript application that uses LocalStorage for saving data, it would be visible to any other ipfs JavaScript application because they all exist under the same domain, right? Have you thought about having the URLs be something like ipfs://<hash>/index.html instead of http://local host/<hash>/index.html so browsers keep the LocalStorage for each ipfs hash separated?

View on HN

We're planning to use Same-origin policy to prevent this. It was first brought up here: https://github.com/ipfs/go-ipfs/issues/651

You can read more about same-origin policy here: https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...

Putting a hash in the hostname/domain would also be using same-origin policy. The issue you linked refers to using suborigins, which seems to still be a draft proposal with no implementer buy-in outside of Chromium [1].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1231225

Could be wrong but I think [beaker](https://beakerbrowser.com/) supports using the protocol like that. Of course its very experimental so if security is a concern then it probably has its own issues.

Reply on news.ycombinator.com