Service Workers allow intercepting requests. Which mean we can create virtual pages that only exists in the browser and not reached servers.
If we create such a virtual page (say /cooks), and set a cookie for /cooks, that cookie should not reach the servers provided that we only request the page after verifying service worker is indeed intercepting. We can do the verification (pre-request) before each request.
Steps would look like this
- Create a virtual page
/cooks/get/randidusing service workers. - Set a cookie with the path set to this page.
- Load a temporary iframe with
src=/cooks/get/randid - There will be a script in the virtual page that reads document.cookie and communicate it with the parent.
This should create a cookie that is never sent to servers.
Why?
Longer lasting session storage that stays in memory (with session cookies).
Browser's session storage, even with a sharing mechanism like Broadcast Channel API only last until all tabs (of the same origin) are closed. But session cookies typically lasts until browser is closed entirely.
This allows closing and re-opening tabs and still having the data in session cookies.
Use Case
Caching encryption keys on client side storage temporarily, reducing writing those keys to disk as much as possible. Because session-cookies are (in most browser defaults) kept in memory.
To me it looks more like a cool idea than a foolproof mechanism but I want to hear your thoughts. Does it work as it looks to me?
