Storage Access Migration Guide

// Top-level page context
// Requests access on behalf
// of embedded.example

await document.requestStorageAccessFor(
  "https://embedded.example"
);
// Grants unpartitioned cookie
// access to embedded.example

// Inside the iframe at
// embedded.example, after a
// user gesture:

const granted =
  await document.requestStorageAccess({
    all: true
  });

// Or check first:
const has =
  await document.hasStorageAccess();
if (!has) {
  await document.requestStorageAccess();
}

// Relied on RWS membership
// to share cookies across
// top-level sites.

// Set-Cookie response header:
Set-Cookie: session=abc123;
  SameSite=None; Secure

// No Partitioned — relies on
// RWS to allow cross-site read

// Set-Cookie response header:
Set-Cookie: session=abc123;
  SameSite=None;
  Secure;
  Partitioned

// Each top-level site gets an
// isolated partition — no
// cross-site data sharing.
// Works without RWS or SAA.

// .well-known/
//   related-website-set.json

{
  "primary":
    "https://brand.example",
  "associatedSites": [
    "https://shop.example",
    "https://auth.example"
  ]
}

// Chrome granted storage
// access automatically to
// RWS members.

// In each cross-site iframe,
// after a user gesture:

// 1. Check first
const has =
  await document.hasStorageAccess();

// 2. Request if needed
if (!has) {
  await document.requestStorageAccess();
}

// 3. Remove the .well-known
// manifest — it has no effect
// in Chrome 152+.