Storage Partitioning
Storage partitioning scopes cookies, cache, and storage per top-level site, so embedded third-party frames can no longer read a shared identity across the sites that embed them.
Definition
Storage partitioning splits per-origin storage — HTTP cache, IndexedDB, localStorage, service workers — by the top-level site in which the origin is embedded. A widget loaded on two different sites sees two separate storage jars, breaking cross-site tracking through storage keys while keeping same-site semantics intact.
Context and scope
Affects embedded login widgets, payment iframes, CDNs serving authenticated media, and any cross-site embed that previously relied on shared cache or storage. Deployed across major browsers as third-party cookies deprecate.
Common misconceptions
- Partitioning only affects cookies — it applies to the HTTP cache, IndexedDB, localStorage, and service worker registrations
- Embeds can opt back into shared storage — only well-defined, privacy-reviewed APIs like storage access restore cross-site access
- Same-site embeds lose storage — partitioning keys by top-level site, so same-site subresources behave as before
Anti-patterns
- Designing login state inside a third-party iframe and breaking silently once each host site gets a separate jar
- Serving authenticated media from a shared CDN and suffering re-authentication per top-level site
- Detecting partitioning via user agent sniffing instead of feature-testing the Storage Access API
Related concepts
Related examples
Authoritative source
https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning
What it is
An embeddable origin historically carried one storage jar wherever it loaded, which is precisely what cross-site tracking needed. Partitioning changes the key from origin to origin plus top-level site, so the same iframe on two publishers is two different clients to its own backend.
How it works
Browsers partition the HTTP cache, storage APIs, and service workers by top-level site. The Storage Access API lets an embedded frame request unpartitioned cookie access with user mediation where policy allows, and Related Website Sets group a limited set of owned sites for legitimate cross-domain flows.
When to care
Embedded login and identity widgets, payment providers, video platforms with per-site entitlements, and cache-hit economics on shared CDNs. Migrate toward first-party storage delegation via postMessage contracts or top-level redirects for sessions.
Pitfalls
Silent breakage: embeds see empty storage rather than errors, which looks like logged-out bugs. Cache partitioning reduces cross-site cache reuse, raising CDN request volume. Test matrix must cover embedded contexts, not just top-level browsing.