-
Notifications
You must be signed in to change notification settings - Fork 33
Description
I would be interested in a requestStorageAccess mechanism for fetch() calls made to third parties. We're building an embeddable javascript widget that would like to fetch()
from a third party with {credentials: "include"}
, but we don't use any iframes.
It looks like we can create an iframe, requestStorageAccess from within, then proxy to the iframe's instance of fetch()
via postMessage, but it would be nice if we could shortcut that process with a requestStorageAccess mechanism for our embedder's instance of fetch().
For extra clarity:
- embedder.com embeds service.com/widget.js
- The code in widget.js makes a
fetch()
request to service.com/api/* with{credentials: "include"}
Third party cookies blockers prevent widget.com from receiving cookies, regardless of if the cookie has SameSite=None. We'd like to override the blocker with explicit user permission, so SameSite=None cookies are included with the request.
Please let me know if this isn't clear!