You are right. This method is just as 'volatile' as any other method that relies on client storage. Cache can be flushed, just like cookies or local storage.