Are Snapshots safe enough?

[Devr-pro]

Snapshots which is recently added feature to SvelteKit is very nice and perfomant, but I noticed a behaviour where it stores the data in sessionStorage and also preserves it untill the website/tab is closed , now a user-password also can be a form field which storing it there might be risky, is this a safe thing to do or there should be some solution to this?

[Rich-Harris]

The short answer is: if something malicious can read sessionStorage, you're already screwed, because it could e.g. read passwords from the DOM just as easily. I don't think there's any new vulnerability exposed by this feature.

The only exception I can think of: you snapshot form fields including a password, someone fills it out, then navigates to an external site, leaves their laptop unattended, and someone navigates back and gets their password that way. If you were building a website for the CIA then I probably wouldn't do that. But even then it's just matching the behaviour that the browser would give you for a traditional app via bfcache — collectively, browser vendors have deemed the 'someone gets access to your laptop' threat model not worth designing around.

[Devr-pro]

Yeah, this clears the doubt 👍