v144 · miscellaneous

Deprecate and Remove: document.requestStorageAccessFor

The requestStorageAccessFor (rSAFor) API is an extension to the Storage Access API that allows a top-level site to request access to unpartitioned ("first-party") cookies on behalf of embedded sites. Browsers will have discretion to grant or deny access, with mechanisms like Related Website Sets (RWS) membership as a potential signal. This allows for use of

concepts

  1. rSAFor Note

    rSAFor — top-level requesting on behalf of embedded sites — is gone. The embedded site itself must call requestStorageAccess() now.

  2. requestStorageAccess vs requestStorageAccessFor

    Compare the per-frame requestStorageAccess() (still here) with the page-wide requestStorageAccessFor() (removed). Probe both APIs and show what migrates to what.

  3. Embedded Flow Rebuilder

    Step the legacy top-level rSAFor sequence side by side with the new per-frame rSA sequence. See where the user activation now sits and what each step has to surface.

  4. Iframe Demo

    A live embedded iframe calling document.requestStorageAccess() from within itself — the surviving API — with a localStorage probe confirming access, and the old vs new code pattern side by side.

why it shipped

Chrome has announced that the current approach to third-party cookies will be maintained. rSAFor currently has usage on about 0.95% of page loads, but any website relying on successful invocation of rSAFor (i.e. the API returns a promise that resolves) must also have registered a set on the RWS GitHub repository. Any invocations of rSAFor outside of an RWS currently returns a promise that is rejected.

references