WebAPI/Security/indexDB

IndexedDB API

References: http://www.w3.org/TR/IndexedDB/

Brief purpose of API: Implementation of W3C spec for IndexedDB

General Use Cases: Storage mechanism for apps.

Threat severity: Low

Regular web content (unauthenticated)

Use cases for unauthenticated code: Store stuff

Authorization model for normal content: Implicit (quota enforced)

Authorization model for installed content: Implicit (no quota)

Potential mitigations: Besides quota, user should be able to use consumption controls to monitor app storage usage.

Privileged (approved by app store)

Use cases for privileged code: Same

Authorization model: Implicit

Potential mitigations: Same

Certified (system-critical apps)

Use cases for certified code: Same

Authorization model: Implicit

Potential mitigations: Same