Activate-Storage-Access
Servers answering embedded cross-site requests control storage access activation through the Activate-Storage-Access response header. The header answers the Sec-Fetch-Storage-Access request signal, telling the browser to activate the context's cookie permission or to retry the request with credentials attached.
Usage
Embedded content holding a storage access permission
still loads without its unpartitioned cookies until
the permission activates. Before the header existed,
activation required the embed to run
document.requestStorageAccess() in script and
reload itself. The header moves the decision to the
server: a response to a request reporting
Sec-Fetch-Storage-Access: inactive names the
activation the server wants, and the browser handles
the rest without any script in the embed.
The header applies only where permission already
exists. A request reporting none has nothing to
activate, and the browser ignores the header on such
responses. Granting the permission in the first
place still runs through the Storage Access API
prompt or a related grant.
Values
retry
The server asks the browser to activate storage
access and repeat the request with unpartitioned
cookies included. The allowed-origin parameter
names the embedding origin permitted to trigger the
retry, and a wildcard covers any embedder.
Activate-Storage-Access: retry; allowed-origin="https://site.example.re"
load
The server accepts the load and asks the browser to activate storage access for the resulting context, without repeating the request. Fitting for document loads where the embed continues with active access.
Activate-Storage-Access: load
Example
An embedded widget request arrives without cookies
while permission exists. The server requests a
credentialed retry, and the repeated request carries
the cookies with Sec-Fetch-Storage-Access: active.
Response to the first request
HTTP/1.1 401 Unauthorized
Activate-Storage-Access: retry; allowed-origin="https://site.example.re"
Vary: Sec-Fetch-Storage-Access
Responses differing by storage access state carry
Vary: Sec-Fetch-Storage-Access so caches separate
the credentialed and uncredentialed answers.
See also
- Storage Access Headers (W3C Privacy CG)
- Sec-Fetch-Storage-Access
- Cookie
- Set-Cookie
- Vary
- HTTP headers