{"action":"created","issue":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/402","repository_url":"https://api.github.com/repos/auth0/auth0.js","labels_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/labels{/name}","comments_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/comments","events_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/events","html_url":"https://github.com/auth0/auth0.js/issues/402","id":217618476,"node_id":"MDU6SXNzdWUyMTc2MTg0NzY=","number":402,"title":"localStorage is spammed with state/nonce combos","user":{"login":"csvn","id":8770194,"node_id":"MDQ6VXNlcjg3NzAxOTQ=","avatar_url":"https://avatars2.githubusercontent.com/u/8770194?v=4","gravatar_id":"","url":"https://api.github.com/users/csvn","html_url":"https://github.com/csvn","followers_url":"https://api.github.com/users/csvn/followers","following_url":"https://api.github.com/users/csvn/following{/other_user}","gists_url":"https://api.github.com/users/csvn/gists{/gist_id}","starred_url":"https://api.github.com/users/csvn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csvn/subscriptions","organizations_url":"https://api.github.com/users/csvn/orgs","repos_url":"https://api.github.com/users/csvn/repos","events_url":"https://api.github.com/users/csvn/events{/privacy}","received_events_url":"https://api.github.com/users/csvn/received_events","type":"User","site_admin":false},"labels":[{"id":446867476,"node_id":"MDU6TGFiZWw0NDY4Njc0NzY=","url":"https://api.github.com/repos/auth0/auth0.js/labels/S2:%20Inconvenient","name":"S2: Inconvenient","color":"1d76db","default":false}],"state":"closed","locked":false,"assignee":{"login":"luisrudge","id":941075,"node_id":"MDQ6VXNlcjk0MTA3NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/941075?v=4","gravatar_id":"","url":"https://api.github.com/users/luisrudge","html_url":"https://github.com/luisrudge","followers_url":"https://api.github.com/users/luisrudge/followers","following_url":"https://api.github.com/users/luisrudge/following{/other_user}","gists_url":"https://api.github.com/users/luisrudge/gists{/gist_id}","starred_url":"https://api.github.com/users/luisrudge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luisrudge/subscriptions","organizations_url":"https://api.github.com/users/luisrudge/orgs","repos_url":"https://api.github.com/users/luisrudge/repos","events_url":"https://api.github.com/users/luisrudge/events{/privacy}","received_events_url":"https://api.github.com/users/luisrudge/received_events","type":"User","site_admin":false},"assignees":[{"login":"luisrudge","id":941075,"node_id":"MDQ6VXNlcjk0MTA3NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/941075?v=4","gravatar_id":"","url":"https://api.github.com/users/luisrudge","html_url":"https://github.com/luisrudge","followers_url":"https://api.github.com/users/luisrudge/followers","following_url":"https://api.github.com/users/luisrudge/following{/other_user}","gists_url":"https://api.github.com/users/luisrudge/gists{/gist_id}","starred_url":"https://api.github.com/users/luisrudge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luisrudge/subscriptions","organizations_url":"https://api.github.com/users/luisrudge/orgs","repos_url":"https://api.github.com/users/luisrudge/repos","events_url":"https://api.github.com/users/luisrudge/events{/privacy}","received_events_url":"https://api.github.com/users/luisrudge/received_events","type":"User","site_admin":false}],"milestone":null,"comments":96,"created_at":"2017-03-28T16:29:27Z","updated_at":"2018-09-21T08:59:30Z","closed_at":"2018-08-28T16:48:13Z","author_association":"NONE","body":"Every time before `auth0.js` performs a redirect to the `/authorize` endpoint, `state` and `nonce` are generated and stored in `localStorage` for verification upon return. If the user lands on the Auth0 hosted login page but does not login, the stored `state/nonce` combo won't be removed.\r\n\r\nThis means that `localStorage` can fill up with lots of unused values, especially during development.\r\n```\r\ncom.auth0.auth.3z-j16G6OFMF_v-nt_QUZS5VV~vf.fGD:\t{\"nonce\":\"55yFu~kZUv0KT6azRtCIyf_c3dx-GAmJ\"}\r\n```\r\n![image](https://cloud.githubusercontent.com/assets/8770194/24415185/ec2b9ea8-13e0-11e7-94d3-8b26c2d499c0.png)\r\n\r\nIs there a reason why this could not be done via a single `localStorage` key, with JSON data?\r\nOr possibly that in addition to `nonce`, a `issuedAt` field could be used for cleaning up old `state/nonce` combos?"},"comment":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/comments/423464838","html_url":"https://github.com/auth0/auth0.js/issues/402#issuecomment-423464838","issue_url":"https://api.github.com/repos/auth0/auth0.js/issues/402","id":423464838,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMzQ2NDgzOA==","user":{"login":"bragma","id":1101058,"node_id":"MDQ6VXNlcjExMDEwNTg=","avatar_url":"https://avatars1.githubusercontent.com/u/1101058?v=4","gravatar_id":"","url":"https://api.github.com/users/bragma","html_url":"https://github.com/bragma","followers_url":"https://api.github.com/users/bragma/followers","following_url":"https://api.github.com/users/bragma/following{/other_user}","gists_url":"https://api.github.com/users/bragma/gists{/gist_id}","starred_url":"https://api.github.com/users/bragma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bragma/subscriptions","organizations_url":"https://api.github.com/users/bragma/orgs","repos_url":"https://api.github.com/users/bragma/repos","events_url":"https://api.github.com/users/bragma/events{/privacy}","received_events_url":"https://api.github.com/users/bragma/received_events","type":"User","site_admin":false},"created_at":"2018-09-21T08:59:30Z","updated_at":"2018-09-21T08:59:30Z","author_association":"NONE","body":"@luisrudge my Auth0 hosted login page directly loads lock 11.9.0 from your CDN. Which version of lock should I use to fix this? Has it already been updated?\r\nThanks!"}}
{"actor":{"display_login":"bragma"}}