[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_162":163,"_164":165},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","testsprivacy","name","storage-test","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_18":55},"id","6c7d20ac-4dd5-453a-b255-f5958ffd2ae7","main.ts","fileId","1f4bdabc-8cd3-11f1-9b9b-1607ee4eb77e","parentId","branchId","e820d99a-a7f7-4560-ae7d-8653d22436a8","branchVersion",7,"latest",true,"createdAt",["D",1785501238696],6,"fileType","http","content","// The embedded frame, hosted on its own domain — see storage-iframe.ts. It must be\n// a different domain from this one or it is not a third-party context at all.\nconst STORAGE_IFRAME_ORIGIN = \"https://storage-test-iframe.val.run\";\nconst STORAGE_IFRAME_WRITE_URL = STORAGE_IFRAME_ORIGIN + \"/write\";\nconst STORAGE_IFRAME_READ_URL = STORAGE_IFRAME_ORIGIN + \"/read\";\n\n// wpt.live is a public web-platform-tests host. set.py turns its query string\n// straight into a Set-Cookie header, and list.py echoes back whatever cookies the\n// server actually received — so list.py showing {} means the cookie was blocked.\nconst WPT_COOKIE_NAME = \"wpt_3p_cookie\";\nconst WPT_COOKIE_VALUE = \"hello_from_wpt\";\nconst WPT_SET_URL = \"https://wpt.live/cookies/resources/set.py?\" +\n WPT_COOKIE_NAME + \"=\" + WPT_COOKIE_VALUE + \";%20SameSite=None;%20Secure\";\nconst WPT_LIST_URL = \"https://wpt.live/cookies/resources/list.py\";\n\nconst landingHtml = `\n\n\n \n \n \n Storage Test Page\n \n \n \n

Storage Test Page

Everything below runs on load. Reload to see whether values persisted.

\n\n

1. First-Party Storage (this page)

Set directly by this page, so it belongs to this origin.

\n \n \n \n

Storage	Status	Value	Detail
Running…

\n\n

2. Iframe Storage (third party: `__IFRAME_LABEL__`)

Set by the framed page below, on a different domain, which reports its results\n up to this page.

\n \n \n \n

Storage	Status	Value	Detail
Waiting for the iframe…

The frame itself:

\n \n\n

3. Third-Party Cookie via wpt.live

The first frame asks wpt.live to set\n __WPT_COOKIE_NAME__=__WPT_COOKIE_VALUE__ with\n SameSite=None; Secure. The second frame then asks wpt.live which\n cookies it actually received.

Empty {} means the third-party cookie was blocked.

\n\n

Setter frame (set.py):

\n \n\n

Verification frame (list.py) — cookies wpt.live received:

\n \n

\n\n

Other pages

/read — read everything back without writing anything

\n\n \n \n\n `;\n\n// The framed page. Served cross-origin this is a third-party context, so every\n// access is wrapped — blocked storage throws rather than returning null.\nconst readHtml = `\n\n\n \n \n \n Read Storages\n \n \n \n

Read Cross Session Storages

This page only reads. Nothing here writes a cookie or a storage,\n so a reload cannot accidentally recreate what you are testing for.

Visit / first, then come back here (or after clearing state /\n waiting out a protection window) to see what survived.

\n\n

1. First-Party Storage (this origin)

\n \n \n \n

Storage	Status	Value	Detail
Reading…

\n\n

2. Iframe Storage (third party: `__IFRAME_LABEL__`)

The framed page below reads its own storage and reports back. It writes nothing.

\n \n \n \n

Storage	Status	Value	Detail
Waiting for the iframe…

The frame itself:

\n \n\n

3. Third-Party Cookie via wpt.live

Asks wpt.live which cookies it receives — list.py only, no setter.

Empty {} means the third-party cookie is gone or was never set.\n Look for __WPT_COOKIE_NAME__.

\n \n

\n\n

Other pages

/ — set first-party, iframe and wpt.live storages

\n\n \n \n\n `;\n\nconst writeHtml = `\n\n\n \n \n \n Write Storages\n \n \n

Write Storages for Cross Session Testing

\n\n \n

\n\n \n\n

Storage Verification

\n \n

IndexedDB Status: Checking...

\n \n\n `;\n\nconst styleCss = `\nbody {\n font-family: sans-serif;\n background: #f9f9f9;\n color: #222;\n margin: 2rem;\n}\n\nh1 {\n color: #3366cc;\n}\n`;\n\nconst scriptJs = `\n\n`;\n// Learn more: https://docs.val.town/vals/http/\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.pathname === \"/write\") {\n return new Response(writeHtml, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n }\n\n if (url.pathname === \"/read\") {\n const body = readHtml\n .replace(\"__IFRAME_READ_SRC__\", STORAGE_IFRAME_READ_URL)\n .replace(\"__IFRAME_LABEL__\", STORAGE_IFRAME_ORIGIN)\n .replace(\"__WPT_LIST_URL__\", WPT_LIST_URL)\n .replace(\"__WPT_COOKIE_NAME__\", WPT_COOKIE_NAME);\n\n return new Response(body, {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n }\n\n if (url.pathname === \"/style.css\") {\n return new Response(styleCss, {\n headers: { \"content-type\": \"text/css; charset=utf-8\" },\n });\n }\n\n if (url.pathname === \"/script.js\") {\n return new Response(scriptJs, {\n headers: { \"content-type\": \"application/javascript; charset=utf-8\" },\n });\n }\n\n if (url.pathname === \"/\") {\n const body = landingHtml\n .replace(\"__IFRAME_SRC__\", STORAGE_IFRAME_WRITE_URL)\n .replace(\"__IFRAME_LABEL__\", STORAGE_IFRAME_ORIGIN)\n .replace(\"__WPT_SET_URL__\", WPT_SET_URL)\n .replace(\"__WPT_LIST_URL__\", WPT_LIST_URL)\n .replace(\"__WPT_COOKIE_NAME__\", WPT_COOKIE_NAME)\n .replace(\"__WPT_COOKIE_VALUE__\", WPT_COOKIE_VALUE);\n\n return new Response(body, {\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"no-store\",\n },\n });\n }\n\n return new Response(\"Not found\", { status: 404 });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_58":59,"_18":60},["D",1785501238696],"children",[],[35],"84c3e9e3-834a-4041-97d0-76486706dbf3",["D",1785497381583],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","99e6832d-c31c-4461-8b4f-4d1fadfb6895","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019fb284-817a-754d-b95e-3ff8e28b627c","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Test","avatar","https://lh3.googleusercontent.com/a/ACg8ocIHl3Yn6Vurlt9n6hZMwUdwDHC_K2jf2v6RGL15sVQnrE-wsA=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":158,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":159,"_95":160,"_97":161,"_99":53},[155],"files",[155],"counts",{"_145":77,"_146":147,"_148":77,"_31":149,"_150":151},[143],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[134,135,136,137],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":142,"_139":-5},{"_33":141,"_139":-5},{"_33":140,"_139":-5},{"_33":138,"_139":-5},"7b9e266d-d5ba-413b-a325-5f733c77c108","reporterId","a3d95789-ce75-405f-8cfc-51b4f01debfd","271d080c-f599-4369-8304-9f35f6b167c7","4c8a0365-174b-4228-8c17-f9c76a74a943",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_18":144},[35],"pulls","branches",1,"forks",{"_152":77,"_154":77},"connections",{"_152":77,"_153":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_58":156,"_18":157},[],[35],["D",1785497381583],{"_11":12,"_115":111},{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_131":195,"_196":197,"_198":199,"_200":53,"_201":53,"_202":53,"_203":44,"_204":-5,"_205":-7,"_206":-7,"_207":77,"_208":53,"_209":53,"_210":-5,"_211":53,"_212":53,"_213":53,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":16,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Storage Test Page

1. First-Party Storage (this page)

2. Iframe Storage (third party: __IFRAME_LABEL__)

3. Third-Party Cookie via wpt.live

Other pages

Read Cross Session Storages

1. First-Party Storage (this origin)

2. Iframe Storage (third party: __IFRAME_LABEL__)

3. Third-Party Cookie via wpt.live

Other pages

Write Storages for Cross Session Testing

Storage Verification

2. Iframe Storage (third party: `__IFRAME_LABEL__`)

2. Iframe Storage (third party: `__IFRAME_LABEL__`)

Code