The Storage Access API provides a way for cross-site content loaded in a third-party context (i.e., embedded in an
Usage of this feature may be blocked by a storage-access Permissions Policy set on your server.
Note: The document may also be required to pass additional browser-specific checks. Examples: allowlists, blocklists, on-device classification, user settings, anti-clickjacking heuristics, or prompting the user for explicit permission.
Although the API surface is the same, websites using the Storage Access API should expect differences in the level and extent of third-party cookie access they receive between different browsers, due to differences in their storage access policies.
SameSite=None explicitly set on them, because the default value for Chrome is SameSite=Lax (SameSite=None is the default in Firefox and Safari).Secure attribute set on them.Document.requestStorageAccessFor() is called because the user is already on the page.tracker.example has already obtained third-party cookie access on the top-level origin foo.example, and the user visits a page from foo.example embedding a page from tracker.example again in less than 30 days, the embedded origin will have third-party cookie access immediately when loading.Documentation for Firefox's new storage access policy for blocking tracking cookies includes a detailed description of the scope of storage access grants.
Document.hasStorageAccess()Returns a Promise that resolves with a boolean value indicating whether the document has access to third-party cookies.
New name for Document.hasStorageAccess().
Document.requestStorageAccess()Allows content loaded in a third-party context (i.e., embedded in an Usage of this feature may be blocked by a Note:\nThe document may also be required to pass additional browser-specific checks. Examples: allowlists, blocklists, on-device classification, user settings, anti-clickjacking heuristics, or prompting the user for explicit permission.\n"}},{"type":"prose","value":{"id":"browser-specific_variations","title":"Browser-specific variations","isH3":false,"content":" Although the API surface is the same, websites using the Storage Access API should expect differences in the level and extent of third-party cookie access they receive between different browsers, due to differences in their storage access policies."}},{"type":"prose","value":{"id":"chrome","title":"Chrome","isH3":true,"content":" Documentation for Firefox's new storage access policy for blocking tracking cookies includes a detailed description of the scope of storage access grants."}},{"type":"prose","value":{"id":"safari","title":"Safari","isH3":true,"content":"\n\n\nstorage-access Permissions Policy set on your server.\n\n\n\n\n
SameSite=None explicitly set on them, because the default value for Chrome is SameSite=Lax (SameSite=None is the default in Firefox and Safari).\nSecure attribute set on them.\nDocument.requestStorageAccessFor() is called because the user is already on the page.\n"}},{"type":"prose","value":{"id":"firefox","title":"Firefox","isH3":true,"content":"\n
tracker.example has already obtained third-party cookie access on the top-level origin foo.example, and the user visits a page from foo.example embedding a page from tracker.example again in less than 30 days, the embedded origin will have third-party cookie access immediately when loading.\n\n