CRITICAL: Credentials stored in localStorage

[CPAtoCybersecurity]

Security Finding

Severity: CRITICAL
Location: src/utils/confluenceSync.js:25-49
CWE: CWE-922 (Insecure Storage of Sensitive Information)

Description

Confluence API credentials and entry mappings are stored in localStorage, which is:

• Accessible via XSS attacks
• Not protected by HttpOnly flag
• Not encrypted
• Readable by any JavaScript on the page

Current Code

export function saveEntryIdMappings(mappings) {
  entryIdMappings = { ...entryIdMappings, ...mappings };
  localStorage.setItem('confluence-entry-mappings', JSON.stringify(entryIdMappings));
}

Recommended Fix

1. Move credential storage to server-side sessions
2. Use httpOnly, Secure, SameSite cookies for session tokens
3. Never store tokens client-side in localStorage
4. Implement proper backend authentication

References

• Arcanum Anti-Patterns: Authentication Failures (Priority Add Data Persistence and Backup Warnings #5)
• OWASP: Sensitive Data Exposure

---

Found by Arcanum sec-context security review