awesome-cross-origin-storage

Awesome Cross-Origin Storage (COS) Awesome

A curated list of resources for the Cross-Origin Storage (COS) API, a proposed Web platform API that lets sites store and retrieve large, content-addressed resources, such as AI models, WebAssembly runtimes, Web fonts, and shared libraries, from a shared, cross-origin storage bucket keyed by the SHA-256 hash of a file’s bytes, so the same bytes don’t need to be downloaded again for every origin that uses them. See the Standardization section below for background.

Cross-Origin Storage icon

Cross-Origin Storage addresses entries by content: navigator.crossOriginStorage.getFileHandle(hash) looks up an entry by the hash of its bytes, so any origin that stores or requests identical bytes resolves to the same entry regardless of the URL it came from. There’s no traditional browser permission prompt. Access is controlled at write time via an origins option: same-site only by default, an explicit list of allowed origins, or '*' for global availability, and visibility can only become more permissive later, never less.

For privacy, a second, independent gate controls whether the browser discloses that a resource exists to a different origin at all. Only entries on the Public Hash List (PHL), a shared, vendor-neutral allowlist of well-known resources (popular libraries, fonts, WebAssembly runtimes, AI models) that meet a minimum cross-origin popularity (k-anonymity) threshold, can be truthfully reported as present to a requesting origin; everything else returns NotFoundError, the same error used when a file is genuinely absent, so cache state can’t be probed cross-origin. Browsers may also randomly return NotFoundError for files that do qualify (“GREASE’ing”), except where the file is large enough that a spurious re-download would be disproportionate to the privacy benefit.

The API isn’t shipped in any browser yet. The projects below currently build against a browser extension (see Implementations below) that polyfills navigator.crossOriginStorage.getFileHandle(), origins-based access control, and a PHL gate backed by a live, community-maintained hash list (see Public Hash List below); the exact gating behavior is still evolving along with the spec. Besides the imperative JS API, the spec also proposes declarative integration via a crossoriginstorage attribute on HTML <link>/<script>, a crossOriginStorage import attribute for JS module imports, and a new <cross-origin-storage> request-url-modifier usable inside CSS url(), for example in @font-face. A fourth integration covers the imperative case: a crossOriginStorage option on fetch()’s RequestInit.

Contents

Implementations

Extensions

Browser extensions that polyfill the proposed API.

Integrations

Projects that have added Cross-Origin Storage support, typically as an opt-in progressive enhancement layered on top of the extensions above.

Prototype Browser Implementations

Native (non-polyfilled) implementations of Cross-Origin Storage in browser engines, ready for testing. Unofficial personal forks, not yet upstreamed.

Public Hash List

Infrastructure behind the PHL availability-gating allowlist described above.

Demos

Working examples of Cross-Origin Storage sharing real-world assets between unrelated origins.

Tools

Standardization

Contributing

Contributions welcome! Read the contribution guidelines first.

This work is licensed under a CC0 1.0 Universal license.

This site is open source. Improve this page.