my current front-end page is http, and then I will store userId in localStorage when I log in for the first time.
because of program defects, as long as localStorage.setItem ("userId",55). If you refresh it, you will be able to display 55% of the private information.
you don"t need an account password, which means: you can see all the user information as long as you have a set of account passwords that you can log in to.
if I use https. Although the requests are encrypted, the front-end program has not changed, so if I continue to localStorage.setItem ("userId",54), I can still see 54 private information.