Switch localStorage to sessionStorage for session ID handling.

[codebyNorthsteep]

This pull request updates the session storage mechanism for chat sessions to improve security and user experience, and enhances frontend security documentation. The most important changes are:

Session Storage Update:

• Changed chat session ID storage from localStorage to sessionStorage in both the frontend logic (app.js) and documentation. This means chat sessions now persist only while the browser tab is open, improving security by clearing sessions when the tab is closed, but still allowing session persistence across page reloads. [1] [2]

Security Documentation Improvements:

• Expanded the security section in the README.md to clarify that all AI-generated Markdown is sanitized with DOMPurify, and added that Subresource Integrity (SRI) is used to ensure external CDN resources are not tampered with.…is to clear session data when tab is closed

Update README.md

Summary by CodeRabbit

• Changes

  • Session persistence mechanism updated to use session-scoped storage. Sessions will now persist across page refreshes within the same browser session but will be cleared when the browser is closed.

• Documentation

  • Security practices documentation expanded to cover content sanitization and external dependency verification methods.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9f9b2e45-0bce-4414-867c-ad6d46fb95b9

📥 Commits

Reviewing files that changed from the base of the PR and between 3ab4c48 and 4e52eb1.

📒 Files selected for processing (2)

• README.md
• src/main/resources/static/app.js

---

📝 Walkthrough

Walkthrough

This PR migrates the Bifrost frontend session ID from localStorage to sessionStorage, changing the persistence scope to the current browser session rather than indefinitely. The implementation change in app.js is accompanied by corresponding documentation updates in README.md describing both the session behavior modification and security features.

Changes

Session Persistence and Security Updates

Layer / File(s)	Summary
Session storage implementation src/main/resources/static/app.js	getSessionId function updated to retrieve and store bifrost_session_id in sessionStorage instead of localStorage, preserving the UUID-generation fallback when no session exists.
Documentation and security updates README.md	Session persistence description updated to reflect sessionStorage usage; security section expanded to explicitly document DOMPurify sanitization of AI-generated Markdown output and Subresource Integrity verification for external CDN libraries.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A rabbit hops through session storage bright,
localStorage bids its farewell tonight,
sessionStorage now holds the session key,
With DOMPurify keeping the AI sanitized and free,
SRI guards the CDN, safe as can be!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching from localStorage to sessionStorage for session ID handling, which is reflected in both the code changes (app.js) and documentation updates (README.md).
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch enhancement/update-session-handling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}