demo · v130

Server-side policy matrix

Six distinct request scenarios crossed against four embed configurations. Pick a scenario; the matrix shows whether the cookie is sent, which header values you should emit (Activate-Storage-Access: retry; allowed-origin, Sec-Fetch-Storage-Access), and whether you'd see the same outcome on Firefox / Safari. The page also generates the exact response headers your server should send.

propertyvaluenotes

recommended response headers from your server



    

  


  

    
the code


// On the third-party server:
function shouldUseRetry(req) {
  return req.headers["sec-fetch-storage-access"] === "inactive"
    && req.cookies.session === undefined;
}

if (shouldUseRetry(req)) {
  res.setHeader(
    "Activate-Storage-Access",
    'retry; allowed-origin="https://embedder.example"'
  );
  res.status(401).send("retry to attach storage");
} else {
  res.setHeader("Activate-Storage-Access", "load");
  // ...respond normally
}

  


  

    
see also