API

CSRF

heads-example.comshoulders-example.comknees-example.comtoes-example.com

example.comexample.uaexample.br

SSO (sso-example.com) (services-example.com)

API Document.requestStorageAccess() Document.hasStorageAccess()

API

Firefox Total Cookie Protection (CHIPS)

API

<iframe> API

1. Document.hasStorageAccess()

2. Document.requestStorageAccess() storage-access

   • Safari
   • Firefox
   • Chrome

3. requestStorageAccess() (Promise)

   <> embedder.com locator.example.com <embedder.com, example.com>

   embedder.com example.com docs.example.com profile.example.com requestStorageAccess()

   : <>

4. <iframe> requestStorageAccess() requestStorageAccess()

   : Safari requestStorageAccess() shop.example.com locator.users.com locator.users.com requestStorageAccess() shop.example.com private.users.com

API requestStorageAccess()

2

• Sec-Fetch-Storage-Access
• Activate-Storage-Access requestStorageAccess()

/

JavaScript

<iframe>

2. • requestStorageAccess() storage-access

storage-access

[ API - ]

URL requestStorageAccess()

[Storage API workflow - activate storage-access permission]

requestStorageAccess()

Sec-Fetch-Storage-Access Activate-Storage-Access

1. Sec-Fetch-Storage-Access: inactive
   • Origin
2. Activate-Storage-Access: retry
   • Sec-Fetch-Storage-Access Vary: Sec-Fetch-Storage-Access
3. Sec-Fetch-Storage-Access: active
4. Activate-Storage-Access: load

[ - ]

1. Sec-Fetch-Storage-Access: none

2. Activate-Storage-Access Vary: Sec-Fetch-Storage-Access

3. storage-access Sec-Fetch-Storage-Access: active

4. Activate-Storage-Access: load

[ ]

Document.requestStorageAccess()

1. • <, > API
   • requestStorageAccess()

2. null

3. Firefox 30

5. <iframe> API allow-storage-access-by-user-activation <iframe> API allow-scripts allow-same-origin

   html

   <iframe
     sandbox="allow-storage-access-by-user-activation
                   allow-scripts
                   allow-same-origin">
     
   </iframe>
   

6. storage-access

API API

Chrome

• SameSite=None Chrome SameSite=Lax Firefox Safari SameSite=None
• Secure
• 30 30 Document.requestStorageAccessFor()

Firefox

• tracker.example foo.example 30 foo.example tracker.example
• 30

Firefox

Safari

• 30 API
• Safari

• API

API

Document.hasStorageAccess()

Promise

Document.hasUnpartitionedCookieAccess()

Document.hasStorageAccess()

Document.requestStorageAccess()

<iframe> Promise

Document.requestStorageAccessFor()

API Promise

API

Permissions.query()"storage-access"

requestStorageAccess()

Permissions.query()"top-level-storage-access"

requestStorageAccessFor() requestStorageAccessFor()

HTTP

Permissions-Policy

Permissions-Policy: storage-access

storage-access Permissions-Policy <iframe> API

Sec-Fetch-Storage-Access

noneinactiveactive

Activate-Storage-Access

Sec-Fetch-Storage-Access

The Storage Access API
Extending Storage Access API (SAA) to non-cookie storage

api.Document.hasStorageAccess

api.Document.hasUnpartitionedCookieAccess

api.Document.requestStorageAccess

api.Document.requestStorageAccessFor

api.Permissions.permission_storage-access

http.headers.Activate-Storage-Access

http.headers.Sec-Fetch-Storage-Access

• API
• Introducing Storage Access API (WebKit blog)