After implemented RWS, still get prompt state and need user gesture to get permission?

[lqw1111]

Hi,
A question about Related websites sets and 3rd party cookies.

Context:
we have two websites, web.com and iframe.com, and iframe.com was embeded in the web.com as iframe, and web.com will postMessage to iframe.com
I am running chrome using this command

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --enable-features=FirstPartySets,StorageAccessAPI,StorageAccessAPIForOriginExtension,PageInfoCookiesSubpage,PrivacySandboxFirstPartySetsUI --test-third-party-cookie-phaseout --use-first-party-set="{\"primary\": \"https://web.com\", \"associatedSites\": [\"https://iframe.com\"]}" https://iframe.com

that is to say web.com and iframe.com was in the same group. And I also I disabled the third party cookies (screenshot)

When I try to access the iframe.com's cookie from web.com by using requestStorageAccess. I check the permission in this way

navigator.permissions.query({name: 'storage-access'}).then(res => {
      console.log(res.state);
      if (res.state === 'granted') {
        // Permission has already been granted
        // You can request storage access without any user gesture
        rSA();
      } else if (res.state === 'prompt') {
        // Requesting storage access requires user gesture
        // For example, clicking a button
        const btn = document.createElement("button");
        btn.textContent = "Grant access";
        btn.addEventListener('click', () => {
          // Request storage access
          rSA();
        });
        document.body.appendChild(btn);
      }
    });

The res.state is always the prompt.

Can you help me understand what happened?
My expectation is that, we can access iframe.com's cookies from web.com without using a user gesture. It's fine to call requestStorageAccess API to access the cookies, but I expected that I can always get the state == grant if I have implemented RSW.

Could you kindly suggest. Thank you in advanced!

[cfredric]

Hi @lqw1111, thanks for testing this!

My expectation is that, we can access iframe.com's cookies from web.com without using a user gesture. It's fine to call requestStorageAccess API to access the cookies, but I expected that I can always get the state == grant if I have implemented RSW.

This isn't quite how it works. RWS just allows Chrome to avoid having to show a storage access permission prompt in some cases; it doesn't preemptively grant storage access to the sites within the RWS. So in other words, I would expect the flow to look like:

1. Load web.com page with iframe.com iframe.
2. The iframe queries the storage-access permission.
   1. If the state is granted, the iframe immediately calls document.requestStorageAccess().
   2. Otherwise the iframe waits for a user gesture and then calls document.requestStorageAccess(). (This is the same logic that you've implemented - it looks correct to me.)
3. Once the user clicks the button, Chrome will automatically grant the storage-access permission (without needing to prompt the user), and unblock cookie access within the iframe.

Can you confirm that that kind of flow works when you test it?

In the screenshot you provided, it looks like the iframe didn't wait for a user gesture before requesting storage access (given the Must be handling a user gesture to use. message). (Alternatively, maybe some of your other code had already consumed the user gesture by the time document.requestStorageAccess() was called; e.g. if you first opened a popup after the button click, then requested storage access.) So I think the document.requestStorageAccess() call was just missing the user gesture.

---

One other note - I'm guessing that the code snippet you gave is pseudocode (and isn't literally what your script executes), given the calls to rSA() instead of document.requestStorageAccess(). But just in case - you'll want to await the promise returned by document.requestStorageAccess(), otherwise the script might continue executing before the browser has finished granting storage access to the iframe.

[lqw1111]

The first time the user visits your page/iframe, the status will be prompt and you will need to request permission with a user gesture; but every visit after that (for at least 30 days), the status will be granted and you do not need a user gesture.

Is it possible to avoid user gesture even at the first time visit? We'd like this grant permission steps is transparent to the user? Is it possible?

[cfredric]

Is it possible to avoid user gesture even at the first time visit?

No, not in Chrome today. This is intentional, for cross-browser-interop. Other browsers don't support Related Website Sets, so in those browsers a user gesture is required and a permission prompt will be shown to the user. Since Chrome also requires a user gesture when permission hasn't been granted yet, your site is more likely to work in other browsers that support the Storage Access API, even without Related Website Sets.

[lqw1111]

I see. Thanks for explanation. @cfredric
I found in the doc https://github.com/GoogleChrome/related-website-sets/blob/main/RWS-Submission_Guidelines.md#browser-behavior

requestStorageAccess and requestStorageAccessFor will be auto-granted for up to five domains in the order listed within the associated subset category.

it mentioned that if we implement RSW, it will be auto-granted for up to five domains. I am curious does it means if we implement RSW, requestStorageAccess will be auto-granted. Does it means we can avoid user gesture even in the first time visit? Can you help understand what does it means.

Thank you!

[cfredric]

Good question - when we say "will be auto-granted", we mean that when your page requests storage access (after satisfying all the constraints Chrome requires of a new request), Chrome will grant the request automatically, without involving the user. It does not mean that Chrome preemptively requests storage access on your sites' behalf; your sites still need to explicitly request storage access, and still need to have the user gesture in order to do so (the first time).

[lqw1111]

Gotcha, that's super helpful, Thank you for the explanation!