Page MenuHomePhabricator

Test cross-domain cookie access with Storage Access API
Closed, DuplicatePublic

Description

Set up two websites on different registrable domains, and test what cross-domain cookie mechanics are enabled by requestStorageAccess() and requestStorageAccessFor() (the Storage Access API and its Chrome extension). This is similar to T359926: Test cross-domain cookie access with the Storage Access API and Related Website Sets except the Storage Access API (without RWS) requires user interaction by design, so instead of an invisible iframe we'll need an iframe or popup with a button, at least some of the time.

The things we want to check:

  • Whether both client-side and server-side cookie access is possible, once the user gave permission.
  • Can we avoid unnecessary user interaction? (Ie. also test hasStorageAccess(), not just requestStorageAccess[For](). If the user has storage access, ideally we'd just use an invisible iframe or an AJAX call.)
  • In the case of requestStorageAccess(), how non-obtrusive can we make the process?
  • T360104: Test cross-domain cookie access with OAuth-style popup + redirect workflow could be folded into this (it's essentially the same thing, just without calling the Storage Access API, and always doing user interaction).

We should also check whether disabling exemption heuristics makes a difference (see docs for Chrome and Firefox), to make sure we aren't attributing something to Storage Access that's actually only possible due to temporary heuristics.

Webkit has some extra rules for using this API, and a debug mode to help understand what's going on.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Relevant (but outdated) description from the parent task:

Use the requestStorageAccess() or requestStorageAccessFor() API, which allow access to third-party cookies. (requestStorageAccess is better supported, but needs to be called by the embedded resource, so it's only usable for iframes; requestStorageAccessFor is called by the embedder.) These would probably be part of using first-party sets, but can be used without those as well; however, then they would require explicit user opt-in (and separately for each domain), making them less practical. Also, they can only be called after user interaction.
support: requestStorageAccess (caniuse) is supported in Firefox and Safari, supported but requires first-party sets in Edge, behind a feature flag in Chrome. requestStorageAccessFor is Chrome-only (chromestatus).

Back when I looked at requestStorageAccessFor, it was still in development. Now caniuse says it's available, but only works between sites of the same RWS set. So it might not be relevant for this task at all.

Tgr updated the task description. (Show Details)

This is similar to T359926: Test cross-domain cookie access with the Storage Access API and Related Website Sets except the Storage Access API (without RWS) requires user interaction by design

As it turns out it requires user interaction with RWS as well. There is probably no point in having two separate tasks, there is a large overlap between the things that need to be checked.