storage partitioning - accessing local storage between an iframe and webpage on the same subdomain

[doubletuna]

Hello,

I’d like to better understand if there is a reasonable solution in the following case:

subdomain: x.whoa.com
3rd party site: something.com

• a 3rd party site opens an iframe from the above subdomain.
• the iframe is setting a local storage data.
• the 3rd party site is then closing the iframe.
• The 3rd party site opens a new window with the above subdomain.

if I set “Experimental third-party storage partitioning.” as “Enabled”, the new window subdomain is not able to access that specific local storage data (left by the iframe, same subdomain).

is there a solution for this scenario, so I can access that local storage data?

Cheers

[wanderview]

There is work going on to support non-cookie storage access via requestStorageAccess():

https://groups.google.com/a/chromium.org/g/blink-dev/c/Mfkj1VqsKX0/m/iLk6xrdMAAAJ

In chrome there is a deprecation trial you can use in the meantime:

https://developer.chrome.com/blog/storage-partitioning-deprecation-trial/

[doubletuna]

Thanks @wanderview

will the suggested solution involve a built in prompt that the user has to approve?

Cheers

[gregotte]

This new partitioning system seems like it will encourage less secure solutions as work arounds. For example, now you have to pass things as query parameters rather then putting thins into local storage. I really wish they didn't make this public without a way to disable via code. I'm surprised that this hasn't broken all sorts of single sign on solutions like it broke mine.

[dmacd]

I have multiple web applications on different subdomains that need to work together seamlessly and securely cache data on the client for sign on flows.

It seems I now have to work around this by full page redirects with query parameters instead of passing data to iframes silently to get the data in localstorage on the correct domain.

[wanderview]

full page redirects

Please be aware of: https://github.com/privacycg/nav-tracking-mitigations/blob/main/bounce-tracking-explainer.md