{"action":"created","issue":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/402","repository_url":"https://api.github.com/repos/auth0/auth0.js","labels_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/labels{/name}","comments_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/comments","events_url":"https://api.github.com/repos/auth0/auth0.js/issues/402/events","html_url":"https://github.com/auth0/auth0.js/issues/402","id":217618476,"number":402,"title":"localStorage is spammed with state/nonce combos","user":{"login":"csvn","id":8770194,"avatar_url":"https://avatars2.githubusercontent.com/u/8770194?v=4","gravatar_id":"","url":"https://api.github.com/users/csvn","html_url":"https://github.com/csvn","followers_url":"https://api.github.com/users/csvn/followers","following_url":"https://api.github.com/users/csvn/following{/other_user}","gists_url":"https://api.github.com/users/csvn/gists{/gist_id}","starred_url":"https://api.github.com/users/csvn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csvn/subscriptions","organizations_url":"https://api.github.com/users/csvn/orgs","repos_url":"https://api.github.com/users/csvn/repos","events_url":"https://api.github.com/users/csvn/events{/privacy}","received_events_url":"https://api.github.com/users/csvn/received_events","type":"User","site_admin":false},"labels":[{"id":446867476,"url":"https://api.github.com/repos/auth0/auth0.js/labels/S2:%20Inconvenient","name":"S2: Inconvenient","color":"1d76db","default":false}],"state":"open","locked":false,"assignee":{"login":"luisrudge","id":941075,"avatar_url":"https://avatars3.githubusercontent.com/u/941075?v=4","gravatar_id":"","url":"https://api.github.com/users/luisrudge","html_url":"https://github.com/luisrudge","followers_url":"https://api.github.com/users/luisrudge/followers","following_url":"https://api.github.com/users/luisrudge/following{/other_user}","gists_url":"https://api.github.com/users/luisrudge/gists{/gist_id}","starred_url":"https://api.github.com/users/luisrudge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luisrudge/subscriptions","organizations_url":"https://api.github.com/users/luisrudge/orgs","repos_url":"https://api.github.com/users/luisrudge/repos","events_url":"https://api.github.com/users/luisrudge/events{/privacy}","received_events_url":"https://api.github.com/users/luisrudge/received_events","type":"User","site_admin":false},"assignees":[{"login":"luisrudge","id":941075,"avatar_url":"https://avatars3.githubusercontent.com/u/941075?v=4","gravatar_id":"","url":"https://api.github.com/users/luisrudge","html_url":"https://github.com/luisrudge","followers_url":"https://api.github.com/users/luisrudge/followers","following_url":"https://api.github.com/users/luisrudge/following{/other_user}","gists_url":"https://api.github.com/users/luisrudge/gists{/gist_id}","starred_url":"https://api.github.com/users/luisrudge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luisrudge/subscriptions","organizations_url":"https://api.github.com/users/luisrudge/orgs","repos_url":"https://api.github.com/users/luisrudge/repos","events_url":"https://api.github.com/users/luisrudge/events{/privacy}","received_events_url":"https://api.github.com/users/luisrudge/received_events","type":"User","site_admin":false}],"milestone":null,"comments":69,"created_at":"2017-03-28T16:29:27Z","updated_at":"2018-05-11T13:14:04Z","closed_at":null,"author_association":"NONE","body":"Every time before `auth0.js` performs a redirect to the `/authorize` endpoint, `state` and `nonce` are generated and stored in `localStorage` for verification upon return. If the user lands on the Auth0 hosted login page but does not login, the stored `state/nonce` combo won't be removed.\r\n\r\nThis means that `localStorage` can fill up with lots of unused values, especially during development.\r\n```\r\ncom.auth0.auth.3z-j16G6OFMF_v-nt_QUZS5VV~vf.fGD:\t{\"nonce\":\"55yFu~kZUv0KT6azRtCIyf_c3dx-GAmJ\"}\r\n```\r\n![image](https://cloud.githubusercontent.com/assets/8770194/24415185/ec2b9ea8-13e0-11e7-94d3-8b26c2d499c0.png)\r\n\r\nIs there a reason why this could not be done via a single `localStorage` key, with JSON data?\r\nOr possibly that in addition to `nonce`, a `issuedAt` field could be used for cleaning up old `state/nonce` combos?"},"comment":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/comments/388359706","html_url":"https://github.com/auth0/auth0.js/issues/402#issuecomment-388359706","issue_url":"https://api.github.com/repos/auth0/auth0.js/issues/402","id":388359706,"user":{"login":"luisrudge","id":941075,"avatar_url":"https://avatars3.githubusercontent.com/u/941075?v=4","gravatar_id":"","url":"https://api.github.com/users/luisrudge","html_url":"https://github.com/luisrudge","followers_url":"https://api.github.com/users/luisrudge/followers","following_url":"https://api.github.com/users/luisrudge/following{/other_user}","gists_url":"https://api.github.com/users/luisrudge/gists{/gist_id}","starred_url":"https://api.github.com/users/luisrudge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luisrudge/subscriptions","organizations_url":"https://api.github.com/users/luisrudge/orgs","repos_url":"https://api.github.com/users/luisrudge/repos","events_url":"https://api.github.com/users/luisrudge/events{/privacy}","received_events_url":"https://api.github.com/users/luisrudge/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T13:14:04Z","updated_at":"2018-05-11T13:14:04Z","author_association":"MEMBER","body":"Previous nonces won't be removed. Are you saying that every new login is adding a new localStorage entry and not cleaning up?"}}
{"actor":{"display_login":"luisrudge"}}