demo · v144

Embedded Flow Rebuilder

rSAFor let the top-level page request unpartitioned-cookie access on behalf of every embedded frame in one shot. That flow is gone. Now each embedded frame asks for itself, on its own user activation, and the prompt is contextual. Step through both sequences side by side.

document.requestStorageAccessFor() is removed in Chrome 144 outside of enterprise policy. The right rebuild is per-frame document.requestStorageAccess() with the user clicking inside the embedded frame.

requestStorageAccess: checking… · rSAFor: checking…

before (rSAFor — removed)

top-level page asked on behalf of N embedded sites. one user gesture covered all of them.

1user lands on top-level publisher.example
2top-level page calls document.requestStorageAccessFor("https://ads.example")
3browser checks RWS membership, may grant silently
4all embedded frames from ads.example get unpartitioned cookies

after (per-frame rSA)

embedded frame asks for itself, when the user clicks. contextual prompt, one frame at a time.

1user lands on top-level publisher.example
2embedded frame renders its own “Continue” button
3user clicks — frame calls document.requestStorageAccess()
4UA shows contextual prompt or grants silently within FedCM/RWS

the API

// before (top-level, removed)
document.requestStorageAccessFor("https://embed.example");

// after (in-frame, must be inside a user-activation event)
button.addEventListener("click", async () => {
  try {
    await document.requestStorageAccess();
    fetch("/me", { credentials: "include" });
  } catch (err) {
    showFallback();
  }
});

see also