← Back to Content

Cross-Domain localStorage: How Browser Fingerprinting Enables Seamless Data Sharing

Discover how browser fingerprinting can create a cross-domain localStorage alternative, enabling secure data sharing between different websites without cookies or CORS restrictions.

Ilkka
cross-domain localStoragebrowser fingerprintingdata sharingweb storagecross-originfingerprint storagethumbmarkjs
Cross-Domain localStorage: How Browser Fingerprinting Enables Seamless Data Sharing

The web's same-origin policy is a fundamental security feature that prevents websites from accessing each other's data. While this protection is essential, it also creates challenges for legitimate use cases where you need to share data across different domains. Traditional solutions like cookies have limitations, and CORS (Cross-Origin Resource Sharing) requires server-side coordination. But what if there was a way to create a cross-domain storage solution using browser fingerprinting?

The Cross-Domain Storage Problem

Traditional Limitations

When building web applications that span multiple domains, developers face several challenges:

  • localStorage is domain-specific: Data stored on example.com isn't accessible from app.example.com

  • Cookies require domain configuration: Cross-domain cookies need careful setup and have size limitations

  • CORS requires server cooperation: Both domains must explicitly allow cross-origin requests

  • Third-party cookies are being phased out: Modern browsers are blocking third-party cookies by default

Real-World Scenarios

These limitations affect common use cases:

  • Multi-tenant SaaS platforms: Sharing user preferences across subdomains

  • E-commerce ecosystems: Cart data across different store domains

  • Analytics and tracking: Consistent user identification across partner sites, including checking whether an affiliate's claim to a conversion matches a real visit

  • Authentication flows: Seamless login across related services

The Browser Fingerprinting Solution

The Core Concept

Browser fingerprinting creates a unique identifier for each visitor based on their browser and device characteristics. Since this fingerprint is consistent across domains (for the same user), it can serve as a "key" for cross-domain data storage.

Here's how it works:

  1. Generate a fingerprint on Domain A

  2. Store data in a backend database using the fingerprint as the key

  3. Generate the same fingerprint on Domain B

  4. Retrieve the data using the matching fingerprint

Why This Works

// On domain-a.com
const fingerprint = await generateFingerprint(); // "abc123def456"
const userData = { theme: 'dark', language: 'en' };

// Store in backend
await storeData(fingerprint, userData);

// On domain-b.com (same user, same browser)
const fingerprint = await generateFingerprint(); // "abc123def456" (same!)
const userData = await retrieveData(fingerprint); // { theme: 'dark', language: 'en' }

Implementing Cross-Domain Fingerprint Storage

Backend Storage Service

Create a simple API that acts like a fingerprint-based localStorage:

// API endpoints
POST /api/fingerprint-storage
{
  "fingerprint": "abc123def456",
  "key": "user-preferences",
  "value": { "theme": "dark", "language": "en" }
}

GET /api/fingerprint-storage?fingerprint=abc123def456&key=user-preferences
// Returns: { "theme": "dark", "language": "en" }

Client-Side Implementation

Using ThumbmarkJS for consistent fingerprinting:

import { Thumbmark } from '@thumbmarkjs/thumbmarkjs';

class CrossDomainStorage {
  constructor(apiEndpoint, apiKey) {
    this.tm = new Thumbmark({ api_key: apiKey });
    this.apiEndpoint = apiEndpoint;
  }

  async setItem(key, value) {
    const { thumbmark } = await this.tm.get();
    
    const response = await fetch(`${this.apiEndpoint}/api/fingerprint-storage`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        fingerprint: thumbmark,
        key,
        value
      })
    });
    
    return response.ok;
  }

  async getItem(key) {
    const { thumbmark } = await this.tm.get();
    
    const response = await fetch(
      `${this.apiEndpoint}/api/fingerprint-storage?fingerprint=${thumbmark}&key=${key}`
    );
    
    if (response.ok) {
      return await response.json();
    }
    return null;
  }
}

// Usage
const crossDomainStorage = new CrossDomainStorage('https://api.example.com', 'your-api-key');

// Store data
await crossDomainStorage.setItem('user-preferences', { theme: 'dark' });

// Retrieve on another domain
const preferences = await crossDomainStorage.getItem('user-preferences');

Advantages of Fingerprint-Based Storage

1. No Domain Restrictions

Unlike localStorage, fingerprint storage works across any domains that implement the same system.

2. No CORS Headers Required

The backend API can serve any domain without complex CORS configuration.

3. Larger Storage Capacity

Unlike cookies, you're not limited to 4KB per domain.

4. Automatic Cleanup

Implement TTL (Time To Live) for automatic data expiration.

5. Privacy-Conscious

No tracking cookies or persistent identifiers required.

Security and Privacy Considerations

Fingerprint Collisions

While rare, fingerprint collisions can occur. Therefore, this approach shouldn't be used for critical data.

Real-World Use Cases

1. Multi-Domain E-commerce

// Store cart items across different store domains
await crossDomainStorage.setItem('cart', {
  items: [{ id: 'product-123', quantity: 2 }],
  total: 99.99
});

2. User Preferences

// Share theme, language, and settings across subdomains
await crossDomainStorage.setItem('preferences', {
  theme: 'dark',
  language: 'en',
  notifications: true
});

3. Acquisition

// Share acquisition attribution across related services
await crossDomainStorage.setItem('attribution', {
  source: 'google',
  medium: 'organic'
});

Limitations and Considerations

1. Fingerprint Stability

Browser updates or configuration changes can alter fingerprints. Consider version-locking ThumbmarkJS.

2. Privacy Regulations

Ensure compliance with GDPR, CCPA, and other privacy laws:

  • Provide clear privacy policies

  • Offer opt-out mechanisms

  • Implement data retention policies

Conclusion

Browser fingerprinting-based cross-domain storage offers a powerful alternative to traditional methods. While not perfect, it provides a practical solution for legitimate use cases where data sharing across domains is necessary.

Key benefits:

  • No domain restrictions: Works across any domains

  • No CORS complexity: Simple API-based approach

  • Privacy-conscious: No persistent tracking cookies

  • Scalable: Can handle large amounts of data

  • Secure: Can implement encryption and access controls

As browser fingerprinting technology continues to improve, this approach will become even more reliable and practical. Tools like ThumbmarkJS make it easy to implement consistent, accurate fingerprinting across different domains.

Get Started

Ready to implement cross-domain storage in your application? Get started with ThumbmarkJS and discover how easy it is to create seamless data sharing across domains.

For more information about browser fingerprinting and cross-domain solutions, visit our documentation or contact our team for personalized guidance.

Want to see this in ThumbmarkJS?

If this would be a useful feature for you, and you'd like to see it implemented in ThumbmarkJS, let us know on GitHub.

Note: This approach should be used responsibly and in compliance with applicable privacy laws and regulations. Always consider the privacy implications and provide appropriate user controls.