Store users hashed PW in localstorage?

Question

I'm writing a web app for 100 users where I work. It is accessible on the internet, not just our intranet. Many users are unskilled users, though most use Chrome as that's the browser that's default on their laptops.

To auth with the web app this is a potential plan:

1. User enters password
2. Password is sent to server
3. Password is hashed and compared with the stored hash
4. If password is right, the browser stores the password in local storage
5. If the users session cookie has expired, javascript posts the stored password on first view so the user doesn't have to reauthenticate

Is this a good idea?

Answer 1

Why bother authenticating at all if you are going to store passwords for users?

How are you going to ensure that another person using their computer cannot access your site?

Passwords are about someone sharing a secret with you, by which they tell you they are who they claim they are (authentication) - doing away with the need to re-authenticate every now and then makes the authentication scheme quite useless.

Answer 2

I dont think that you should store the user's password on the client side for what you are trying to achieve . It can be done through cookies .
So suppose the user has authenticated , then maybe you could make a cookie that would reside on their machine for a couple of weeks and that would serve as their gate pass .
Storing passwords ( that too non encrypted ) is not recommended .

Answer 3

This doesn't quite make sense. It sounds like the server doesn't support "Remember me" and you're trying to add it using the client. Why not just support it on the server? There are plenty of existing tutorials and questions on setting it up (try this search), but it basically means having a special login cookie with a randomly generated value (kept track of by the server) and a long (maybe a couple weeks, not forever) expiry. Storing the password, even hashed, opens the user up to indefinite (until the password is changed) replay attacks if someone gains access to the database.