79

HTML5's localStorage databases are usually size-limited — standard sizes are 5 or 10 MB per domain. Can these limits be circumvented by subdomains (e.g. example.com, hack1.example.com and hack2.example.com all have their own 5 MB databases)? And is there anything in the standard that specifies whether parent domains can access their children's databases? I can't find anything, and I can see arguments for doing it either way, but it seems like there has to be some standard model.

Julien Kronegg
  • 4,968
  • 1
  • 47
  • 60
Chuck
  • 234,037
  • 30
  • 302
  • 389
  • 1
    I'm working right now with a program where we are trying to completely store all text in localStorage. It would be awesome if you could add some links to where you found this information about the current 5MB limit. It would help me understand the alternatives better. Thanks – JeroenEijkhof May 06 '10 at 07:34
  • 6
    Webkit-based browsers use UTF-16 for storage which haves it to 2.5MB limit. – rxgx Oct 27 '10 at 14:49
  • 8
    Note, the June 2011 RFC says that "User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in a1.example.com, a2.example.com, a3.example.com, etc, circumventing the main example.com storage limit." So don't count on that hack continuing to work in the future. ( http://dev.w3.org/html5/webstorage/ ) – Joseph Lust Jun 30 '11 at 21:09
  • 2
    The limit can be artificially "expanded" a great deal by using compression. Fast algorithms can be used safely such as mine: http://pieroxy.net/blog/pages/lz-string/index.html – pieroxy May 21 '13 at 09:35
  • There's some research done: http://www.computerworld.com/s/article/9237259/HTML5_Web_Storage_loophole_can_be_abused_to_fill_hard_disks_with_junk_data However, the problem is, what with 2nd level top-domains such as com.de or org.pl? – Danubian Sailor Dec 03 '13 at 15:31

5 Answers5

52

From http://dev.w3.org/html5/webstorage/#disk-space

A mostly arbitrary limit of five megabytes per origin is recommended. Implementation feedback is welcome and will be used to update this suggestion in the future.

It also mentions that :

User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in a1.example.com, a2.example.com, a3.example.com, etc, circumventing the main example.com storage limit.

Clay Nichols
  • 11,848
  • 30
  • 109
  • 170
Vetle
  • 3,287
  • 2
  • 27
  • 28
  • 5
    This doesn't really answer the question about subdomains. – Jörn Zaefferer Jan 17 '12 at 12:57
  • 15
    @JörnZaefferer, the *intent* of the spec is to prevent using subdomains. – Clay Nichols May 22 '12 at 15:15
  • 4
    It's interesting to note that despite the warning in the spec, apparently only FireFox implemented the suggested prevention. See this project for a fun way to fill your disk/crash your browser: http://feross.org/fill-disk/ – Adam Tuttle Feb 28 '13 at 13:02
  • None of the answers are actually an answer to the question that said this one's the closest I suppose just have to read between the lines and follow the links etc – FreeSoftwareServers Feb 14 '22 at 00:10
15

Here's a pretty detailed test result with plenty of desktop and mobile browsers covered: http://dev-test.nemikor.com/web-storage/support-test/

Which confirms this bug report: http://code.google.com/p/chromium/issues/detail?id=58985#c15

You can rely on only 2.5MB, not 5MB, based on the string length that you can store.

Jörn Zaefferer
  • 5,665
  • 3
  • 30
  • 34
8

I missed this question when I asked "Is 5MB the de facto limit for W3C Web Storage?", but I got basically the same answer. If you want more information, I did link to some browser specific limits in my question.

Community
  • 1
  • 1
Kevin Hakanson
  • 41,386
  • 23
  • 126
  • 155
6

A better solution is to use the [HTML5 IndexedDB for offline storage.]1

It looks like the replacement for the old Web SQL (which seems to be misnamed b/c it's for offline storage) is: Indexed DB, which allows offline storage and is still supportd:

IndexedDB is new in HTML5. Web Databases are hosted and persisted inside a user's browser. By allowing developers to create applications with rich query abilities it is envisioned that a new breed of web applications will emerge that have the ability to work online and off-line.

More info and a test-app at: http://ido-green.appspot.com/WebSQL-IndexedDB-example/jqm_indexedDB.html

Clay Nichols
  • 11,848
  • 30
  • 109
  • 170
  • No IndexedDB support on mobile for now (might be upcoming in iOS 7). So might be better to create a persistence api wrapping WebSQL and IndexedDB until IndexedDB is better supported on mobile http://caniuse.com/#search=indexeddb – oligofren Aug 02 '13 at 08:53
  • This should be a comment, since it doesn't answer the question. – Danubian Sailor Dec 03 '13 at 15:24
  • 1
    I actually think it's likely to provide the best possible advice for someone who asks the initial question. Separately, there exists a decent polyfill library that implements indexedDB on top of WebSQL for the older mobile browsers. – Jon Watte Sep 17 '14 at 16:01
2

To get 50MB of storage space use code below

// 1. paste this line in your code
!function(){function e(t,o){return n?void(n.transaction("s").objectStore("s").get(t).onsuccess=function(e){var t=e.target.result&&e.target.result.v||null;o(t)}):void setTimeout(function(){e(t,o)},100)}var t=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB||window.msIndexedDB;if(!t)return void console.error("indexDB not supported");var n,o={k:"",v:""},r=t.open("d2",1);r.onsuccess=function(e){n=this.result},r.onerror=function(e){console.error("indexedDB request error"),console.log(e)},r.onupgradeneeded=function(e){n=null;var t=e.target.result.createObjectStore("s",{keyPath:"k"});t.transaction.oncomplete=function(e){n=e.target.db}},window.ldb={get:e,set:function(e,t){o.k=e,o.v=t,n.transaction("s","readwrite").objectStore("s").put(o)}}}();

// 2. Setting values
ldb.set('nameGoesHere', 'value goes here');

// 3. Getting values - callback is required because the data is being retrieved asynchronously:
ldb.get('nameGoesHere', function (value) {
  console.log('And the value is', value);
});

source https://github.com/DVLP/localStorageDB

Pawel
  • 16,093
  • 5
  • 70
  • 73