Skip to main content

WebOptions

Specific options for the Web platform for secure storage.

Configures database, encryption, and storage behavior on web platforms.

Properties

  • db_name - The name of the database used for secure storage.
  • public_key - The public key used for encryption.
  • use_session_storage - Whether to use session storage instead of local storage.
  • wrap_key - The key used to wrap the encryption key.
  • wrap_key_iv - The initialization vector (IV) used for the wrap key.

Properties​

db_nameclass-attributeinstance-attribute​

db_name: str = 'FletEncryptedStorage'

The name of the database used for secure storage.

public_keyclass-attributeinstance-attribute​

public_key: str = 'FletSecureStorage'

The public key used for encryption.

use_session_storageclass-attributeinstance-attribute​

use_session_storage: bool = False

Whether to use session storage instead of local storage.

wrap_keyclass-attributeinstance-attribute​

wrap_key: str = ''

The key used to wrap the encryption key.

wrap_key_ivclass-attributeinstance-attribute​

wrap_key_iv: str = ''

The initialization vector (IV) used for the wrap key.

Important Security Considerations​

SecureStorage uses an experimental implementation using WebCrypto API. Use at your own risk. The browser creates the private key, and encrypted strings in localStorage are not portable to other browsers or machines and will only work on the same domain.

You MUST have HTTP Strict Forward Secrecy enabled and proper headers applied to your responses, or you could be subject to JavaScript hijacking.

Required security measures:

  • Enable HSTS (HTTP Strict Transport Security)
  • Use proper security headers

References:

Application-Specific Key Wrapping​

On web, all keys are stored in LocalStorage. You can wrap this stored key with an application-specific key to make it more difficult to analyze:

storage = SecureStorage(
    web_options=WebOptions(
        wrap_key='your_application_specific_key',
        wrap_key_iv='your_application_specific_iv',
    ),
)