demo · v144
SSO Migration Architect
RWS let you list brand.com, brand-help.com, brand-blog.com as related and share cookies between them. With RWS removed, you need a real cross-origin identity story — subdomains under one eTLD+1, OAuth/OIDC, FedCM, or the per-frame Storage Access API. Drop your sites in and the architect builds the recommended stack.
RWS removal in Chrome 144. The architect below issues the same advice the team is publishing: collapse to one eTLD+1 where you can, FedCM where you have a real IdP, and OAuth/OIDC for the rest.
hasStorageAccess: checking…
your sites
recommended stack
—
what each path looks like
// path A — collapse to one eTLD+1
// brand.com / shop.brand.com / help.brand.com share cookies with Domain=brand.com
// path B — FedCM (if you have a real IdP)
const cred = await navigator.credentials.get({ identity: { providers: [{ configURL: "https://idp.example/fedcm.json", clientId: "..." }] }});
// path C — per-frame Storage Access API (still here, just not unilateral via rSAFor)
await document.requestStorageAccess(); // inside a user-gesture, per embedded frame
// path D — OAuth/OIDC redirect with PKCE
location.href = "https://idp.example/authorize?response_type=code&client_id=..." +
"&redirect_uri=https://brand-shop.com/cb&code_challenge=...";