demo · v141

SAA Strict SOP

Compose two URLs and watch the classifier decide whether they share a site (the old, looser SAA boundary) versus a full origin (the new boundary). The page also probes the live document.requestStorageAccess() surface.

before 141 — site-keyed

—

141+ — strict origin-keyed

—

No verdict yet.
click probe to test live API

the policy

// Old behavior (pre-141):
//   requestStorageAccess() in https://embed.example.com:8443
//   would attach cookies to https://api.example.com   (different port, same site)
//
// New behavior (141+):
//   the access only applies to requests with the SAME scheme/host/port
//   as the iframe — sub.example.com:8443 → api.example.com → BLOCKED
//
// Override via enterprise policy or per-Storage-Access-Headers.

see also