demo · v130

Storage Access Headers live probe

Toggle the embed state, call a real server endpoint, and inspect the actual request headers your browser sent plus the Activate-Storage-Access response header the server emitted.

1 — actual request observed by server


      

      

        
2 — actual server response headers

        

      

      

        
3 — observed follow-up request

        

      

      

        
4 — latest probe payload

        

      

    


    

  


  

    
the code


# 1. Browser sends an unauthenticated request:
Sec-Fetch-Storage-Access: none

# 2. Embedded server replies — if it wants to use cookies and the user
#    already granted permission, it can either ACTIVATE for THIS load,
#    or ask for a RETRY with cookies attached:
Activate-Storage-Access: retry; allowed-origin=*

# 3. Browser retries — cookies attached, storage-access activated:
Sec-Fetch-Storage-Access: active
Cookie: session=abc123

# 4. Server can now serve the personalised response.

  


  

    
see also