> Markdown version of [/videos/2162-what-is-cross-origin-storage-thomas-steiner](https://www.wearedevelopers.com/videos/2162-what-is-cross-origin-storage-thomas-steiner). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # What is Cross-Origin Storage - Thomas Steiner Thomas Steiner proves shared browser caching isn't dead. Discover how the Cross-Origin Storage API securely shares massive web AI models across domains without triggering privacy-compromising timing attacks. - **Speakers:** Thomas Steiner - **Event:** Coffee With Developers - **Published:** August 31, 2026 - **Duration:** 34:51 - **URL:** https://www.wearedevelopers.com/videos/2162-what-is-cross-origin-storage-thomas-steiner ## Summary The historical promise of shared browser caching—epitomized by the era of shared jQuery CDNs—ultimately failed due to the rise of JavaScript bundling and the necessity of strict cache isolation to prevent privacy-compromising timing attacks. The Cross-Origin Storage (COS) API emerges as a modern solution to this problem, operating as a content-addressable storage system. By identifying and retrieving resources via cryptographic content hashes (like SHA-256) rather than origin-specific URLs, COS enables browsers to securely share identical files across different domains without exposing user browsing habits. This technology is primarily driven by the bandwidth-heavy demands of modern web development, specifically web AI, massive WebAssembly modules (like FFmpeg or SQLite), and comprehensive CJK or emoji web fonts. Downloading a 2.5-gigabyte AI model repeatedly across different web applications is prohibitive, making COS a critical enabler for production-grade AI on the client side. To mitigate the security vulnerabilities that plagued older shared caches, COS enforces a "public cache list" that restricts global sharing to verifiably popular resources. It also strictly limits the number of cache probes a page can perform, preventing malicious actors from building identifying bit vectors based on the specific files stored in a user's cache. Designed natively as a progressive enhancement, the COS API gracefully falls back to a standard network fetch if a browser does not support the protocol. Developers can test the imperative and declarative API entry points today using specialized browser extensions or experimental Chromium builds, with major ecosystem partners like Transformers.js, Emscripten, and Nuxt already building out integrations. Highlighting the importance of early adoption and community feedback, Thomas Steiner notes, "This time, I hope we have a chance to get it right by working with the frameworks... from the start," urging engineering teams to provide quantifiable usage metrics on GitHub to help solidify the WICG standard. **Keywords:** cross-origin storage api, content-addressable storage, web ai model caching, browser cache isolation, timing attack mitigation, sha-256 resource hashing, declarative cache attributes, webassembly module sharing, public cache list, cache probing limits, progressive enhancement patterns, transformers.js integration, nuxt framework optimization, cjk web font caching, wicg standard proposals ## Chapters 1. **Overcoming historical web caching and privacy challenges** (00:56) — How partitioned browser caches broke shared content delivery networks to prevent timing attacks. 1. **Solving storage constraints for web AI and fonts** (03:48) — Why large assets like local AI models and comprehensive emoji fonts require a new caching mechanism. 1. **Addressing shared web resources by content hash** (06:09) — Using content-addressed storage to verify and share resources regardless of their original download URL. 1. **Managing sharing levels with the imperative API** (07:28) — How to use JavaScript to query the cache and configure global, same-site, or origin-specific sharing. 1. **Opting into shared caching with declarative HTML attributes** (09:37) — Adding specific attributes to script and link tags enables seamless integration with cross-origin storage. 1. **Preventing malware distribution through decentralized hash verification** (11:07) — Validating incoming bytes against known hashes stops compromised domains from serving malicious code. 1. **Understanding underlying browser storage implementations and tooling** (14:23) — How browser vendors might adapt existing mechanisms like IndexedDB or OPFS to store cached blobs. 1. **Mitigating timing attacks and managing storage quotas** (16:59) — Protecting user privacy by enforcing popularity thresholds and probe limits on cached resources. 1. **Expanding ecosystem adoption across WebAssembly and AI frameworks** (20:15) — How partners use the API to share complex dependencies like Skia rendering engines and compiled database libraries. 1. **Testing the proposed API using browser extension polyfills** (23:06) — Developers can experiment with the cross-origin storage proposal immediately using offscreen page service workers. 1. **Integrating storage across CSS and Fetch API endpoints** (24:54) — Modifying standard request options allows developers to cache assets through font-face declarations and network requests. 1. **Providing usage metrics to support browser vendor implementation** (27:44) — Expressing developer interest with concrete metrics helps prioritize the API standardization process. 1. **Integrating shared caching with modern web framework bundlers** (32:57) — Using plugins for tools like Vite enables frameworks to optimize resource delivery natively. ## Related Moments - [Solving cross-origin model size and native performance limitations](https://www.wearedevelopers.com/videos/1615-prompt-api-webnn-the-ai-revolution-right-in-your-browser) (from "Prompt API & WebNN: The AI Revolution Right in Your Browser") - [Introduction to web acceleration and caching paradigms](https://www.wearedevelopers.com/videos/1676-http-headers-that-make-your-website-go-faster) (from "HTTP headers that make your website go faster") - [Managing local storage footprints for progressive browser AI systems](https://www.wearedevelopers.com/videos/1743-wearedevelopers-live-ai-vs-the-web-ai-in-browsers) (from "WeAreDevelopers LIVE – AI vs the Web & AI in Browsers") - [Querying cold storage directly from the browser](https://www.wearedevelopers.com/videos/1999-tracking-vehicles-at-scale) (from "Tracking vehicles at scale") - [Improving asset caching through localized font deployments](https://www.wearedevelopers.com/videos/1334-wearedevelopers-live-web-typography-css-layout-features-staying-curious-in-an-ai-world-and-more) (from "WeAreDevelopers LIVE - Web Typography; CSS Layout features; Staying curious in an AI world and more") - [The origins and design principles of WebAssembly](https://www.wearedevelopers.com/videos/673-fun-with-paas-how-to-use-cloud-foundry-and-its-uniqueness-in-creative-ways) (from "Fun with PaaS – How to use Cloud Foundry and its uniqueness in creative ways") ## Related Articles - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 116 - WWWAI?](https://www.wearedevelopers.com/magazine/449-dev-digest-116-wwwai) - [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss) - [Dev Digest 101 - the XXX edition](https://www.wearedevelopers.com/magazine/382-dev-digest-101-the-xxx-edition) ## Related Jobs - [Software Engineer, Fullstack](https://www.wearedevelopers.com/jobs/48415-software-engineer-fullstack) at **Sciforium** - [Principal Software Engineer, AI Tools and Security](https://www.wearedevelopers.com/jobs/48450-principal-software-engineer-ai-tools-and-security) at **Docker, Inc.** - [Senior AI Serving Engineer, Backend](https://www.wearedevelopers.com/jobs/48414-senior-ai-serving-engineer-backend) at **Sciforium** - [Lead Software Engineer, Model Serving Platform](https://www.wearedevelopers.com/jobs/48413-lead-software-engineer-model-serving-platform) at **Sciforium** - [Principal Engineer - AI Search & Vector Infrastructure](https://www.wearedevelopers.com/jobs/ext/353953-principal-engineer-ai-search-vector-infrastructure) at **Redis** - [Senior Software Engineer, Sandboxes (Eu Or East Coast Preferred)](https://www.wearedevelopers.com/jobs/ext/2161904-senior-software-engineer-sandboxes-eu-or-east-coast-preferred) at **Docker, Inc.**