Partitioned Popins: a new approach to Web pop-ups in Developer Trial

Natalia Markoborodova

From Chrome 132, developers can participate in a Developer Trial for a new approach to Web pop-ups: Partitioned Popins. This Developer Trial is only available for Desktop, and the feature is not yet available on Android.

A partitioned popin is a new type of pop-up designed for short-lived interactions, such as logins or quick confirmations. It loads web content with two unique features:

• Storage partitioned by opener
• A modal-like UI

Note: An opener of a partitioned popin is the web page that the popin was opened on.

Why do we need partitioned popins?

Partitioned popins are designed to maintain the privacy properties of a partitioned iframe and the security properties of pop-ups.

As more users opt in to browsing without third-party cookies, flows that rely on storing data in a pop-up for retrieval in a third-party context later (for example, to maintain user session across sites) may be disrupted. Partitioned popins aim to address this issue.

How do partitioned popins work?

Each partitioned popin's storage is partitioned to its opener. Storage partitioning limits access to cross-site data, mitigating tracking risks and script injection attacks. Learn how storage partitioning works in our documentation.

Consider an opener.example website that embeds content from third-party.example. To display personalized content on opener.example, the user needs to sign in on third-party.example. When third-party cookies are blocked in the user's browser, the current pop-up flow is as follows:

1. The user clicks a login button.
2. A dialog opens.
3. The user logs in from the top level context of third-party.example, and an unpartitioned authentication cookie is written.
4. The third-party.example content embedded on opener.example doesn't have access to its own top-level cookies written on third-party.example when it was presented in a first-party context. This happens because the authentication cookie is unpartitioned and is therefore a third-party cookie.

Pop-up flow: The third-party.example iframe embedded on opener.example doesn't have access to its own unpartitioned cookie set in the top-level context of the third-party.example pop-up.

The storage of a partitioned popin is partitioned to the opener. This changes the steps 3-4 of the flows:

1. The user logs in from the top-level context of third-party.example. As it's open in a partitioned popin, the storage is partitioned by opener.example.

   Note: If third-party cookies are blocked, popins cannot access cookies set in the top-level context. In our example, cookies set when third-party.example is opened in a separate browser window are unavailable in the third-party.example popin or iframe.

2. The third-party.example content embedded on the opener.example has access to its own cookie that was set in the popin, since they share the same partitioned storage.

Partitioned popins flow: The third-party.example iframe embedded on opener.example has access to its own partitioned cookie set in the top-level context of the third-party.example popin, because the cookie is partitioned by opener.example.

Modal-like UI relative to its opener tab

Partitioned popins aim to help the user understand that the opener and the popin are related:

• When the user switches to another tab, the popin automatically becomes invisible and inaccessible, the same way a modal is only visible when the opener tab is active.
• When the user returns to the opener tab, the popin is shown again.
• The user cannot make changes in the popin's browser address bar.

Note: The Partitioned Popins feature is in active development. The UI is subject to change, aiming to improve user experience. Share your feedback to help us make this feature better.

Storage partitioning with partitioned popins: an iframe embedded on the opener page can access storage set within the popin.

Try it out

Chrome 132 is introducing a Developer Trial for the Partitioned Popins feature. This means that the feature will be available behind a flag. Here's how you can try partitioned popins:

1. Make sure you're using Chrome 132 or later.
2. Navigate to chrome://flags#partitioned-popins and enable the feature flag.
3. Restart Chrome.
4. Try out our demo.

Use partitioned popins on your website

Note: During the Developer Trial, popins won't be available to your users unless they have the feature flag enabled. Follow the Developer blog to get the latest updates.

To use a partitioned popin on your website, call the window.open() method with the popin parameter passed:

window.open("third-party-popin.example", "_blank", "popin");

Important: If third-party cookies are disabled in the browser, partitioned popins will reject any unpartitioned cookies. Partition your cookies with CHIPS to make them available across the embedded content on your site and the popin.

Share your feedback

We're exploring partitioned popins and looking for developer feedback. Here are some potential use case scenarios:

• User authentication flow. If you have a custom authentication flow implemented, and the authentication happens on a different domain than your site (for example, site.example users sign in on auth-site.example), try opening the authentication page in a popin to use the session cookie on the opener page.
• Embedded content. Try partitioned popins to display additional content from a third-party widget, such as a settings dialog, an image or a PDF (or other content that is usually loaded in a pop-up), rendered in a larger window. In this case, partitioned popins aim to retain the user session state between the third-party widget and your site.

If you have any of these scenarios in your solutions, have other use cases in mind, or want to help shape the future of this feature, try it out and let us know:

• Did you encounter any issues?
• Do you have any suggestions for a better user experience?
• Do you have any suggestions for a better UI? Specifically, do you find that the UI clearly indicates that the opener and the popin are related?
• How useful do you find this feature?
• Are there other use cases you would like to use partitioned popins for?

File an issue on GitHub to share your thoughts.