localStorage is not visible in iFrame

Question

We have a sporadic issue when we setup some data to the localStorage in a separate tab, then when we load the same domain in the same browser in iFrame under another domain, we don't see those data. The issue happens only to some specific user and locally we can not reproduce it.

Most of users who has this issue are using Windows OS. The workflow we use is the next.

1. Open a new tab with a project domain like internal.com
2. Login the user and store the access token to the localStorage
3. Open client's project domain like external.com
4. Make sure that 3rd-party cookies are enabled
5. Add an iFrame under external.com with the internal.com address
6. Verify that the content of internal.com is loaded in iFrame as expected

What is the expected result?

In the localStorage of the iFrame with the internal.com address under the external.com tab, we should see the data we set in the browser tab with the internal.com address

What happens instead?

The localStorage of the iFrame with the internal.com address under the external.com tab is empty.

We started getting such issue since the beginnign of August, approximately. Anybody has faced the same or know the reason?

We've checked all the possible browser settings, insluding 3rd-party cookies and CORS policies.

---

Here are some official resources to follow-up the issue:

• https://bugs.chromium.org/p/chromium/issues/detail?id=1482192#c9
• https://groups.google.com/a/chromium.org/g/blink-dev/c/24hK6DKJnqY/m/ChL2WWx5CgAJ
• https://bugs.chromium.org/p/chromium/issues/detail?id=1476059

Bonilla

Answer 1

I was fighting to it all day long.

https://developer.chrome.com/en/docs/privacy-sandbox/storage-partitioning/

That was the reason. New chrome experimental feature. Just disable it.

chrome://flags/#third-party-storage-partitioning.

Also check your browser third party cookie permissions. It also should be allowed.

Bernetta

Ok, but how to make it work for every client? I cannot ask all of them to disable this feature. We have an application (called A) which stores data in local storage and that data should be retrievable when A is embedded into other pages as iframe. But with this chrome feature now the webpage A cannot see it's own saved data in local storage when embedded into other pages. – Madeup

@Madeup as far as I know there's currently no way that you can programmatically solve this. There's a discussion to create an API to using localStorage with default partition, you can follow the issue here github.com/privacycg/storage-access/issues/102 – Thimblerig