demo · v138

Eligibility checker

The shared-cache carve-out is not a free-for-all. Chrome only de-partitions resources that meet a strict set of criteria the team published when proposing the feature. Paste a URL and we walk through the checklist Chrome would apply.

Awaiting URL.

the criteria, as proposed

  1. HTTPS only. The cache key is the URL; an attacker on an HTTP origin could otherwise pre-poison the bucket.
  2. Public, static, content-addressed. The same bytes regardless of who’s asking — no cookies, no auth headers, no per-session data in the response.
  3. Strong integrity binding. Chrome stores the SHA-256 of the body. A subsequent fetch only hits the shared bucket if its computed digest matches — otherwise it falls back to the partitioned cache.
  4. On the curated allowlist. Chrome ships an explicit list of URLs (low hundreds) measured to dominate cross-site reuse. New URLs aren’t shared just because they look popular.
  5. Compression dictionary or script/style. The carve-out is scoped to script, style, and dictionary resources — HTML, images, and JSON stay partitioned.

see also