The current steps of document.hasStorageAccess() do a few baseline checks (for an inactive document, opaque origins, insecure context), but the meat of the steps are:
- Check whether the user agent's settings explicitly allow/disallow cookie access for the given {site, site} pair, without taking the environment's
has storage access bool into account. Returns true/false if access was explicitly allowed/disallowed, respectively.
- If the environment is same-authority with the top-level browsing context (i.e. if the whole frame hierarchy is same-site), then return true.
- Check the
storage-access permission status. If the status is "granted", return the environment's has storage access.
- Return false.
The big problems with this are:
- It's possible for
document.hasStorageAccess() to return false even if cookies are accessible.
- It's possible for
document.hasStorageAccess() to return true even if cookies are not accessible at all (if the user agent disables cookies, i.e. navigator.cookieEnabled is false).
In other words, the document.hasStorageAccess() steps currently do not guarantee the semantics we agreed on in #171 (comment).
We should refactor the spec steps to really check cookie accessibility, so that document.hasStorageAccess() returns true iff setting an unpartitioned cookie would work in that context (modulo the baseline/security checks above).
The current steps of
document.hasStorageAccess()do a few baseline checks (for an inactive document, opaque origins, insecure context), but the meat of the steps are:has storage accessbool into account. Returns true/false if access was explicitly allowed/disallowed, respectively.storage-accesspermission status. If the status is "granted", return the environment'shas storage access.The big problems with this are:
document.hasStorageAccess()to return false even if cookies are accessible.document.hasStorageAccess()erroneously always returns false for A(B(A)) embeds #234).document.hasStorageAccess()to return true even if cookies are not accessible at all (if the user agent disables cookies, i.e.navigator.cookieEnabledis false).In other words, the
document.hasStorageAccess()steps currently do not guarantee the semantics we agreed on in #171 (comment).We should refactor the spec steps to really check cookie accessibility, so that
document.hasStorageAccess()returns true iff setting an unpartitioned cookie would work in that context (modulo the baseline/security checks above).