Storage Partitioning Breaks CHAPI

[TaylorBeeston]

Google has started rolling out Storage Partitioning, and it caused an odd headache for me that completely broke CHAPI.

Because of Storage Partitioning, authn.io suddenly had different localStorage partitions in different CHAPI sites, meaning if I registered a wallet at https://learncard.app, then tried to issue a VC into it at https://vcplayground.org, when VC Playground opens authn.io, it has no idea that I've registered over at LearnCard. Even worse, if I select LearnCard from the suggested list, https://learncard.app now also has its own localStorage partition in the embedded iframe, meaning I am now completely logged out!

I was able to fix this by going to chrome://flags and explicitly disabling Experimental third-party storage partitioning.

If I understand correctly, opening authn.io/the embedded site in a popup will defeat this, since those become the top level site in the popup, but this is currently not happening, and is leading to a very broken, confusing experience =/

[TaylorBeeston]

Related issue?

[dlongley]

Thanks for reporting this. It looks like we'll need to switch Chrome over to using the popup mechanism that other browsers use. Unfortunately, there doesn't seem to be an easy way to feature detect this -- so we'll just switch things over. People may lose their wallet registrations and have to register again, but that should be a one time thing.

[BigBlueHat]

We now use the popup mechanism as of the 6.0.0 release of the mediator:
https://github.com/credential-handler/authn.io/blob/main/CHANGELOG.md?plain=1#L3-L6

Consequently, this is not so much "fixed" as "acknowledged as an unavoidable reality" and things now work the same across all similar environments.