demo · v130

no-iframe flow

The chromestatus motivation: "limits use cases by requiring the embedded resources to use an iframe." Storage Access Headers let an authenticated embed opt in to unpartitioned cookies on any cross-site network request, not just iframe loads. This page walks through the three-hop header negotiation for a subresource (an <img>, <script>, or fetch()) — no iframe needed.

Storage Access Headers spec walkthrough The wire-level header negotiation runs inside Chrome's network stack — there is no JS surface to call. This page reproduces the request/response sequence for a non-iframe subresource so you can see what changes vs the legacy JS-only Storage Access API.
scenario:

vs the legacy iframe path

before Storage Access Headers

  • Embed must be an <iframe> — image/script/fetch subresources can't request unpartitioned cookies.
  • Iframe loads its document. document.hasStorageAccess() probes.
  • If not granted, iframe calls document.requestStorageAccess(). Returns a promise.
  • User-visible permission flow may appear.
  • Iframe waits, then re-issues the request that needed the cookies.
  • Two extra round-trips per cold start. Useless if you only need a single fetch.

Chrome 130+: header negotiation

  • Subresource sends one request. Browser advertises Sec-Fetch-Storage-Access.
  • Server inspects the header. If it has already-granted permission, it can respond with Activate-Storage-Access in a single round-trip.
  • If permission isn't granted yet, the server returns Activate-Storage-Access: load with a load-time prompt — still no iframe required.
  • Works for any cross-site subresource: <img>, <script>, fetch(), <link rel=preload>.

the headers

# Browser includes the header on every cross-site request that may
# have storage access available:
Sec-Fetch-Storage-Access: none      # request not yet using SA
Sec-Fetch-Storage-Access: active    # request is sent with SA
Sec-Fetch-Storage-Access: inactive  # would be active if server activates

# Server can include either of these in its response:
Activate-Storage-Access: retry; allowed-origin="https://embed.example"
Activate-Storage-Access: load       # block subresource, ask user

# Once activated, subsequent requests get the unpartitioned cookies
# until the SA permission expires.

see also