storage partitioning - accessing local storage between an iframe and webpage on the same subdomain

wanderview / quota-storage-partitioning

9 stars 6 forks source link

storage partitioning - accessing local storage between an iframe and webpage on the same subdomain #8

Open doubletuna opened 12 months ago

doubletuna commented 12 months ago

Hello,

I’d like to better understand if there is a reasonable solution in the following case:

subdomain: x.whoa.com 3rd party site: something.com

a 3rd party site opens an iframe from the above subdomain.
the iframe is setting a local storage data.
the 3rd party site is then closing the iframe.
The 3rd party site opens a new window with the above subdomain.

if I set “Experimental third-party storage partitioning.” as “Enabled”, the new window subdomain is not able to access that specific local storage data (left by the iframe, same subdomain).

is there a solution for this scenario, so I can access that local storage data?

Cheers

wanderview commented 12 months ago

There is work going on to support non-cookie storage access via requestStorageAccess():

https://groups.google.com/a/chromium.org/g/blink-dev/c/Mfkj1VqsKX0/m/iLk6xrdMAAAJ

In chrome there is a deprecation trial you can use in the meantime:

https://developer.chrome.com/blog/storage-partitioning-deprecation-trial/

doubletuna commented 11 months ago

Thanks @wanderview

will the suggested solution involve a built in prompt that the user has to approve?

Cheers

gregotte commented 8 months ago

This new partitioning system seems like it will encourage less secure solutions as work arounds. For example, now you have to pass things as query parameters rather then putting thins into local storage. I really wish they didn't make this public without a way to disable via code. I'm surprised that this hasn't broken all sorts of single sign on solutions like it broke mine.

dmacd commented 7 months ago

I have multiple web applications on different subdomains that need to work together seamlessly and securely cache data on the client for sign on flows.

It seems I now have to work around this by full page redirects with query parameters instead of passing data to iframes silently to get the data in localstorage on the correct domain.

wanderview commented 7 months ago

full page redirects

Please be aware of: https://github.com/privacycg/nav-tracking-mitigations/blob/main/bounce-tracking-explainer.md