[SECURITY] Plaintext user credentials are stored in localStorage

[Akshu121796]

Description

The application currently stores user credentials, including the user's password, directly in the browser's localStorage.

Affected Files

Registration

localStorage.setItem('registeredPassword', pwd);

TransplantChain-Organ_Donation_Application-main/src/register.html

Login

const registeredPassword = localStorage.getItem('registeredPassword');

TransplantChain-Organ_Donation_Application-main/src/login.html

The same implementation also exists under:

• Version_1_Frontend/src/register.html
• Version_1_Frontend/src/login.html

Security Impact

Storing passwords in localStorage is insecure because:

• Any JavaScript running on the page (including malicious scripts injected through XSS) can read the password.
• Credentials remain stored even after the browser is closed until manually cleared.
• Anyone with access to the user's browser profile can retrieve the password.
• It violates common web security best practices for authentication.

Suggested Fix

• Do not store passwords in localStorage.
• Delegate authentication to the backend.
• Store only non-sensitive session information after successful authentication.
• If client-side persistence is required, use secure session/token mechanisms instead of storing plaintext passwords.

Acceptance Criteria

• Passwords are no longer stored in localStorage.
• Login functionality continues to work correctly.
• No plaintext credentials are persisted in the browser.
• Existing authentication flow remains functional.

[Akshu121796]

Hi @jaideep005,
i would work on this issue under gssoc'26
While reviewing the authentication flow, I identified a security issue where user passwords are stored in plaintext in the browser's localStorage.

I'd like to work on fixing this issue by removing local password storage while preserving the existing authentication flow.

Thanks!

[Akshu121796]

@jaideep005 Thanks for assignin, I'll soon raise a PR!

[Akshu121796]

@jaideep005 check the PR!