save_site_data.notes

When to save

Save once a sign-in is confirmed, not before: check the page shows you are in, then call save_site_data. One save keeps every cookie, the localStorage of each site a call has ended on — read in a hidden tab that never loads the site — and the sessionStorage of the page it is on. Each save replaces the last, so a save after signing out saves you signed out.

What restore does

Every browser opened in the workspace has it all back before open_session returns, including the one that replaces a reaped browser: cookies first, then each site's storage, then the page's sessionStorage, then the first page. open_session names the sites in site_data; after a silent reopen, the call that noticed carries that report once. open_session(restore_site_data=false) opens with nothing and deletes what was saved, which is how you start as a new user; where the workspace has been is kept.

Limits

IndexedDB is not saved, and sessionStorage only for the page saved on. Only the sites in the workspace's history are read: a site passed through inside one call is not, and one last visited over a day ago, or beyond the newest 100, loses its saved storage at the next save while its cookies stay. A site whose service worker answers the hidden tab is not read there: it keeps its last saved storage, and a save made while on it reads it directly. An httpOnly cookie cannot be set from a script, so it is restored through the browser's own channel and shown as ••• on every surface. Saved data lives with the workspace's record and expires with it: never on this server's disk, and with the Redis store as durable as Redis. A site that stores what you typed — a token typed through a secret and kept in localStorage — makes it readable in site data; httpOnly cookies stay masked.