demo · v138

Allowlist explorer

Cache sharing only kicks in for an explicit allowlist of resources that meet five criteria. Paste any URL and the page walks through each gate, telling you exactly why a resource qualifies — or doesn't — for cross-origin cache sharing.

Unflagged in Chrome 138, gated by criteria. Cache partitioning still applies broadly — only resources on the allowlist (heavy, immutable, semver-pinned, served by tiny number of origins, no cookies) get shared.
probing…

Known good candidates (try them)

Verdict

paste a URL.

Five-gate checklist

If shared · projected savings

—
resource size
—
est. monthly cache hits
—
bytes saved (est.)

The five criteria

  1. Versioned URL — the URL must contain an immutable version (path segment like /3.6.0/, /v2/, content hash). Mutable URLs poison the cache.
  2. Cache-Control: public, immutable — origin commits to the resource never changing. Cache duration ≥ 1 year.
  3. No cookies, no auth — the request must not include credentials. Personal data must never enter a shared cache.
  4. SHA-256 integrity — Chrome verifies a hash of the body. Tampering by an upstream proxy is caught.
  5. On the allowlist — the host must be on the explicit, audited list of pervasive CDNs. Initial list includes jsDelivr, cdnjs, unpkg, googleapis, gstatic, and a few others.

Why bother

The pre-2020 web shared cache for jQuery / Bootstrap / Lodash across origins. A user who'd already downloaded jquery-3.6.0.min.js once didn't download it again. Cache partitioning (2020) closed that as a privacy hardening — sites could no longer use shared cache as a tracking signal. The cost was up to 90% redundant downloads of a small set of extremely popular resources. v138's allowlisted scheme restores the saving for that small set, with the privacy properties intact.

see also