v144 · privacy · demo

Iframe Demo

document.requestStorageAccessFor() is removed in Chrome 144. The correct replacement is document.requestStorageAccess() called from within the iframe. This demo shows the before-and-after side by side, then runs a live probe from an injected same-origin iframe.

requestStorageAccessFor let the top-level page request cookie access on behalf of embedded sites. That is gone. The embedded frame must now ask for itself, triggered by a user gesture inside that frame.
requestStorageAccess (rSA): checking… requestStorageAccessFor (rSAFor): checking…

before — rSAFor (removed)

Called on the outer page. Accessed cookies for every embedded frame from origin X in one shot. Required Related Website Sets membership.

// top-level page (outer.html)
// ✗ REMOVED in Chrome 144
await document.requestStorageAccessFor(
  "https://embed.example"
);
// All <iframe src="https://embed.example/...">
// now get unpartitioned cookies — if RWS member.

after — rSA from iframe (still here)

Called inside the embedded frame on user interaction. The user activation requirement lives where the user actually sees the UI.

// inside embed.html (the iframe document)
// ✓ Still supported
button.addEventListener("click", async () => {
  try {
    await document.requestStorageAccess();
    // frame now has unpartitioned cookie access
    const res = await fetch("/me", {
      credentials: "include"
    });
  } catch (err) {
    showLoginFallback();
  }
});

Live Iframe Probe

Click "Run Probe" to inject a same-origin <iframe> that calls document.requestStorageAccess(). The iframe posts its result back via postMessage.

Probe not run yet. Click "Run Probe" to inject the iframe.

localStorage Read / Write Test

Verify first-party storage access by writing and reading a key. In a legitimate embedded-rSA context, this storage is shared with the top-level origin's partition.

keyvalue

how the migration shape changes

// BEFORE — top-level page, removed in Chrome 144
// outer page calls on behalf of ad.example frames
document.requestStorageAccessFor("https://ad.example")
  .then(() => console.log("all frames from ad.example have cookies"));

// AFTER — each frame calls itself
// embed.html served at https://ad.example/widget
const btn = document.getElementById("continue-btn");
btn.addEventListener("click", async () => {
  try {
    await document.requestStorageAccess();
    // Now fetch with credentials — this frame has unpartitioned access
    const me = await fetch("https://ad.example/api/me", { credentials: "include" });
  } catch {
    // Show a "log in" fallback; the user denied or UA disallowed
  }
});

see also