title: Can localStorage be modified by a client?
body: <p>I'm attempting to use localStorage as a cookie replacement (detest cookies) so users can stay signed in on a site I operate.</p>
  <p>What I planned so far was to save the user's username in localStorage, and have the site check whether anything was in localStorage, and if anything <em>is</em> in localStorage, it'd push the localStorage data to a PHP file via POST and push the user to start a new PHP session and return them back to where they were.</p>
  <p>Though I have the concern, I know localStorage can be viewed, in which case possibly encrypting the data server-side would make some sense.</p>
  <p>But can LocalStorage data be modified? If not, this would be fine to do, even without encryption, but obviously if a user could modify the localStorage data, they would have access to others' accounts, which as you can imagine, isn't a good thing.</p>
  <p>I had the doubt because JavaScript can be executed by a client in a browser, ie:</p>
  <pre><code>javascript:alert(&quot;hello&quot;);
  </code></pre>
  <p>Couldn't it be possible to find out the localStorage's var name and reset it's value like this?</p>
  <pre><code>javascript:localStorage.setItem('sessionusername','superadmin');
  </code></pre>
  <p>Basically, I ask: Can HTML5 Local Storage data be modified on client side?</p>