← Back to release summary

Storage Access API

Category
Offline / Storage
Type
New or changed feature
Status
Enabled by default (Chrome 115)
Intent stage
Prepare to ship

Summary

Browsers may block third-party resources from accessing cookies and other storage for privacy and security reasons. The most popular reason is cross-site tracking prevention. Such blocking breaks authenticated cross-site embeds such as commenting widgets, embedded payment providers, and subscribed video services. The Storage Access API provides a means for authenticated cross-site embeds to check their blocking status and request access to storage if they are blocked.

Motivation

As privacy is becoming increasingly important to users, requests for stricter browser defaults and user opt-in settings like blocking all third-party storage access are increasingly common. While these settings help improve privacy and block unwanted access by unknown or untrusted parties, they can have unwanted side effects such as blocking access to content the user may want to view (e.g. social media and embedded media content). Users shouldn't have to compromise between privacy protections and enabling sites' embedded content to function correctly. The Storage Access API is a JavaScript API that allows fine-grained control of storage access permissions when access would otherwise be denied by the browser's current settings. Sites with meaningful scenarios that depend on loading third-party resources will be able to leverage the API to allow the user to explicitly choose, on an as-needed basis, when to allow more permissive access.

Standards & signals

Docs: https://docs.google.com/document/d/1q5Q-8MJcfZamGAXLpjiXiPYR1Tov5JOGw0Z8Fv0TWFk

Samples: https://webkit.org/blog/8124/introducing-storage-access-api

Explainers: https://github.com/privacycg/storage-access

View on chromestatus.com