v141 · security

Strict Same Origin Policy for Storage Access API

In Chrome 141, Storage Access API semantics now strictly follow the Same Origin policy, to enhance security. Using `document.requestStorageAccess()` in a frame only attaches cookies to requests to the iframe's origin (not site) by default. The [CookiesAllowedForUrls](https://chromeenterprise.google/policies/#CookiesAllowedForUrls) policy or Storage Access

concepts

  1. SAA Strict SOP

    Storage Access API tightens its same-origin check to the full scheme/host/port triple. Closes an edge case where requests across port boundaries could be wrongly granted.

  2. Origin vs Site

    Matrix of six cross-origin same-site fetch targets, showing the before / after of the strict-SOP change. Pinpoints exactly which patterns break.

  3. Migration with Storage Access Headers

    The three-step opt-in handshake (Sec-Fetch-Storage-Access → Activate-Storage-Access) for sites that need the loose site-wide scope.

  4. Storage Access Tester

    Interactive same-site / cross-origin matrix: pick a top-level origin and an embedded-frame origin, click "Request Storage Access", and see the real document.requestStorageAccess() outcome with an explanation of which SOP rule applied and what the strict-origin change means for that pair.

why it shipped

This change improves the security properties of the Storage Access API, without affecting privacy boundaries. It brings the Storage Access API's SOP semantics more inline with the rest of the web platform, which makes the API more intuitive for web developers.

references