v153 · privacy-sandbox · storage-access · deprecation
Deprecate and Remove: document.requestStorageAccessFor()
Chrome 153 removes document.requestStorageAccessFor() (rSAFor), a top-level page API that allowed sites to request Storage Access on behalf of embedded cross-site resources. rSAFor was only useful in conjunction with Related Website Sets, which is also being removed.
document.requestStorageAccessFor() is being removed from Chrome. Calls will throw or be rejected. Use the standard document.requestStorageAccess() from within the embedded frame instead.
at a glance
| Shipped in | Chrome 153 (Stepped rollout — removal begins) |
|---|---|
| Status | Deprecation / removal in progress |
| Replacement | document.requestStorageAccess() called from within the embedded iframe |
| Standards position (Firefox) | No signal |
| Standards position (Safari) | No signal |
| ChromeStatus | 5162221567082496 — Deprecate and Remove: document.requestStorageAccessFor |
background
document.requestStorageAccessFor(requestedOrigin) (rSAFor) was a Chrome-specific extension to the Storage Access API. Unlike the standard document.requestStorageAccess() (which must be called from within the embedded iframe), rSAFor was called by the top-level page to request access on behalf of a cross-site embed. This allowed RWS-member sites to grant each other storage access without the embedded frame needing to initiate the request.
Because rSAFor was tightly coupled to Related Website Sets (which is also being removed), it has no standalone use case and is being removed alongside it.
Source: chromestatus feature summarymigration
| Before (Chrome rSAFor) | After (standard SAA) |
|---|---|
// Top-level page requests access for embed |
// Embed requests its own access |
The standard Storage Access API (document.requestStorageAccess()) must be called from within the iframe that needs access, and typically requires a user gesture. This is the cross-browser standard path.