Web

Browser Storage Capability Probe

Suggest an improvement

Run active write, read, and delete checks in the current browser or iframe context, then export a reason-coded report without uploading values.

Operation

write / read / delete

Network

no requests

Evidence

current context only

Active capability check

Test the browser context you are in

Temporary values are created, verified, and removed. Run this page inside the same iframe context as your widget when testing third-party policy.

No browser storage touched yet

The probe runs only after an explicit click.

Widget integration

Run the same operation inside your iframe

async function probeStorage(storage, key) {
  const value = crypto.randomUUID();
  try {
    storage.setItem(key, value);
    if (storage.getItem(key) !== value) {
      return { ok: false, reason: "read_mismatch" };
    }
    storage.removeItem(key);
    if (storage.getItem(key) !== null) {
      return { ok: false, reason: "delete_failed" };
    }
    return { ok: true, reason: "ok" };
  } catch (error) {
    const name = error instanceof DOMException ? error.name : "Error";
    return {
      ok: false,
      reason:
        name === "SecurityError" || name === "NotAllowedError"
          ? "security_error"
          : name === "QuotaExceededError"
            ? "quota_exceeded"
            : "unknown_error",
    };
  }
}

const result = await probeStorage(
  window.localStorage,
  "__widget_storage_probe__",
);
window.parent.postMessage(
  { type: "widget-storage-probe", result },
  "https://YOUR-HOST-ORIGIN.example",
);

Replace the exact targetOrigin, verify both event.origin and event.source in the host, and send only reason codes, never tokens or durable identity.

01

How to use

  1. 01Open the page in the same top-level or iframe context as the application you are testing.
  2. 02Run the probe to create, verify, and remove temporary values in localStorage, sessionStorage, IndexedDB, and a CHIPS cookie candidate.
  3. 03Read each operation and reason code; Storage Access API inspection does not request permission.
  4. 04Copy the JSON report or adapt the bounded iframe snippet with an exact targetOrigin.
02

FAQ

Does a pass prove storage survives reloads?
No. A pass proves only that a temporary value could be written, read, and deleted in the current browser context. Reload durability, eviction, quota and future policy still need deployment testing.
Can this prove an HttpOnly CHIPS cookie works?
No. JavaScript cannot inspect HttpOnly cookies. The cookie check uses a short-lived script-readable Partitioned candidate; verify the real server-issued HttpOnly cookie through response headers and authenticated server behavior.
Does it request Storage Access API permission?
No. It only calls hasStorageAccess() when the page is embedded. Permission prompts and user-gesture flows must remain explicit in the application being tested.
Does the probe send storage values to MonoTools?
No. Temporary values stay in the current browser context, are removed after each check, and are omitted from the exported report.
03

Related tools