Set up two websites on different registrable domains, and test what cross-domain cookie mechanics are enabled by requestStorageAccess() and requestStorageAccessFor() (the Storage Access API and its Chrome extension). This is similar to T359926: Test cross-domain cookie access with the Storage Access API and Related Website Sets except the Storage Access API (without RWS) requires user interaction by design, so instead of an invisible iframe we'll need an iframe or popup with a button, at least some of the time.
The things we want to check:
- Whether both client-side and server-side cookie access is possible, once the user gave permission.
- Can we avoid unnecessary user interaction? (Ie. also test hasStorageAccess(), not just requestStorageAccess[For](). If the user has storage access, ideally we'd just use an invisible iframe or an AJAX call.)
- In the case of requestStorageAccess(), how non-obtrusive can we make the process?
- T360104: Test cross-domain cookie access with OAuth-style popup + redirect workflow could be folded into this (it's essentially the same thing, just without calling the Storage Access API, and always doing user interaction).
We should also check whether disabling exemption heuristics makes a difference (see docs for Chrome and Firefox), to make sure we aren't attributing something to Storage Access that's actually only possible due to temporary heuristics.
Webkit has some extra rules for using this API, and a debug mode to help understand what's going on.