Skip to content

Chrome 141/Firefox 140 storage access activation per origin #28682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrisdavidmills merged 12 commits into from
Jan 19, 2026
Merged

Chrome 141/Firefox 140 storage access activation per origin #28682

Changes from 6 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
258f40b
Chrome 141/Firefox 140 storage access activation per origin
chrisdavidmills Dec 16, 2025
f762117
Update http/headers/Activate-Storage-Access.json
chrisdavidmills Dec 17, 2025
87efd15
Merge branch 'main' into storage-access-activation-per-origin-not-site
chrisdavidmills Jan 5, 2026
6b8aeeb
Merge branch 'main' into storage-access-activation-per-origin-not-site
chrisdavidmills Jan 14, 2026
30dd2a4
fixes for caugner review comments
chrisdavidmills Jan 14, 2026
013858e
revert unwanted changes
chrisdavidmills Jan 14, 2026
e615c8b
Merge branch 'main' into storage-access-activation-per-origin-not-site
chrisdavidmills Jan 16, 2026
60207ab
Add separate strict_same_origin_policy feature
chrisdavidmills Jan 16, 2026
2c160fc
Update api/Document.json
chrisdavidmills Jan 16, 2026
8eec95a
Remove note, improve URL
chrisdavidmills Jan 16, 2026
65bbc2d
Merge branch 'main' into storage-access-activation-per-origin-not-site
chrisdavidmills Jan 19, 2026
0953692
Fix linting error
chrisdavidmills Jan 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions api/Document.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7278,7 +7278,8 @@
],
"support": {
"chrome": {
"version_added": "119"
"version_added": "119",
"notes": "From version 141 onwards, activating the `storage-access` permission via `requestStorageAccess()` results in third-party cookies being sent only with requests to the calling embed's exact origin (see [bug 379030052](https://crbug.com/379030052)). Before version 141, it resulted in third-party cookies being sent with requests to the calling embed's site."
},
"chrome_android": {
"version_added": "120"
Expand All @@ -7287,15 +7288,19 @@
"version_added": "85"
},
"firefox": {
"version_added": "65"
"version_added": "65",
"notes": "From version 140 onwards, activating the `storage-access` permission via `requestStorageAccess()` results in third-party cookies being sent only with requests to the calling embed's exact origin (see [bug 1965817](https://bugzil.la/1965817)). Before version 140, it resulted in third-party cookies being sent with requests to the calling embed's site."
Copy link
Contributor

@caugner caugner Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked internally for confirmation that this is the right bug.

},
"firefox_android": "mirror",
"oculus": "mirror",
"opera": "mirror",
"opera_android": "mirror",
"safari": {
"version_added": "11.1",
"notes": "Client-side storage access granted per-page ([see explanation](https://developer.mozilla.org/docs/Web/API/Storage_Access_API#how_it_works))"
"notes": [
"Client-side storage access is granted per-page ([see explanation](https://developer.mozilla.org/docs/Web/API/Storage_Access_API#how_it_works)).",
"`storage-access` activation results in third-party cookies being sent with requests to the calling embed's site."
Copy link
Contributor

@caugner caugner Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Either this note describes the expected behavior before the spec change (then let's remove this note), or it describes a particular Chrome behavior before the spec change (then let's remove the note to the subfeature).

Copy link
Contributor Author

@chrisdavidmills chrisdavidmills Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rats, I meant to remove that note, but forgot. Removed now.

I also updated the URL on the remaining note line to point directly at the note that explains "granted per-page", as the existing URL wasn't very effective.

]
},
"safari_ios": "mirror",
"samsunginternet_android": "mirror",
Expand Down