Comments Off on Sanitizing DOM Storage: Preventing Persistent Tracking Local Storage
While traditional tracking cookies are easily monitored and restricted through standard browser settings, modern web tracking networks frequently exploit a more persistent data pipeline known as DOM Storage (or Web Storage). Consisting of localStorage and sessionStorage, this API allows websites to store large amounts of data directly inside your browser profile. Unlike cookies, DOM storage parameters do not have built-in expiration dates and remain on your local disk indefinitely unless explicitly sanitized.
The Architectural Threat of localStorage
DOM storage was designed to improve web performance by caching application states locally, but it has evolved into a resilient vector for device fingerprinting and user tracking. Because standard cookie-clearing tools often leave DOM storage databases untouched, data brokers use these local repositories to re-create deleted tracking cookies—a process known as “evercookies.” This allows a site to rebuild your tracking profile even after you have cleared your standard history.
Toggling Storage Bounds via about:config
In a hardened Firefox environment, you can control or entirely disable this storage mechanism by modifying core preferences. If you want to shut down the DOM storage subsystem completely, navigate to about:config and adjust the following value:
Set dom.storage.enabled to false: This completely blocks websites from reading or writing to local and session storage APIs. Note that while this provides an absolute defensive perimeter, it will break complex web applications and modern login sessions that rely on local tokens to track state.
The Minimalist Alternative: Enforcing Session Limits
For users who require a functional web interface without persistent tracking overhead, leaving DOM storage enabled but forcing it to act like a temporary session cookie is the optimal approach. In standard configurations or specialized builds like Librewolf, this is achieved by setting your browser to clear all history and site data upon closing the application process. This preserves operational functionality while ensuring that your local disk returns to a clean slate every time you exit your browser.
