demo · v130

Header Round-trip Probe

Chrome 130's Storage Access Headers replace the iframe-only requestStorageAccess() JS flow with a pure HTTP header dialogue. This demo calls a real endpoint, records the request headers your browser sent, and surfaces the Activate-Storage-Access response header the server emitted.

Resource type

Storage-access permission

Third-party cookies

Server Activate-Storage-Access

// Chrome 130: Storage Access Headers — server-side activation
// No iframe needed; works for fetch(), <img>, <script>, etc.

// Step 1: Browser sends Sec-Fetch-Storage-Access on cross-site request
// GET /api/data HTTP/1.1
// Sec-Fetch-Storage-Access: inactive   ← permission granted but cookies not attached

// Step 2: Server sends Activate-Storage-Access to attach cookies
// HTTP/1.1 401 Unauthorized
// Activate-Storage-Access: retry; allowed-origin="https://publisher.example"

// Step 3: Browser retries with unpartitioned cookies attached automatically
// GET /api/data HTTP/1.1
// Cookie: session=abc123   ← unpartitioned, active now
// Sec-Fetch-Storage-Access: active

see also