Cross Origin Storage API: Stop Downloading Files Twice

The Cross-Origin Storage API could let browsers share a 33 GB AI model between two sites, cutting the data you download from 66 GB to 33 GB.

Browsers used to let any site reuse a file that another site had already fetched. Load the same React bundle from a CDN on two pages and the browser serves the cached copy the second time. A series of privacy-focused changes broke that convenience: browsers now partition caches by site, so even identical URLs are stored separately for each origin. The result is duplicate traffic for every large asset that appears on more than one site.

Why the duplicate-download problem matters now

The waste shows up with small files—web fonts or a few megabytes of JavaScript—but it explodes when the asset is a multi-gigabyte AI model or a WebAssembly module.

How the Cross-Origin Storage (COS) API works

The proposal swaps URL-based lookup for a content-addressed one. A site supplies a SHA-256 hash of the file it wants. The browser checks its local store for that exact hash, regardless of which origin originally fetched it. If the file is present, the browser hands it over; if not, it fetches the file from the network and stores it under that hash for future cross-origin reuse.

  • Identify by hash. The hash uniquely represents the file’s bytes, not its location.
  • Cross-origin access. Any site that knows the hash can request the file, even if it originated elsewhere.
  • Local cache sharing. The same physical copy satisfies multiple requests.

The API is deliberately narrow: it does not replace the existing Cache API or IndexedDB. Those remain the tools for general-purpose storage; COS is a single-purpose shortcut for large, identical blobs.

Privacy safeguards built into the design

Allowing sites to probe a user’s cache could re-introduce the tracking vectors that partitioned caches were meant to stop. COS blocks that risk with three rules:

  1. No enumeration. Scripts cannot ask “what hashes do you have?”—the storage is opaque.
  2. Known-hash requirement. A site may only request a file if it already knows the exact hash. Random probing is impossible without prior knowledge.
  3. Popularity threshold for global access. A file must be sufficiently common—i.e., “anonymous”—before a different origin can retrieve it. Rare files stay isolated to the origin that first downloaded them.

These limits keep the API useful for truly shared assets while preventing it from becoming a side channel for fingerprinting.

What to watch next

The Cross-Origin Storage API offers a straightforward fix to a problem that has grown with massive in-browser assets. Whether the web community can balance bandwidth efficiency against the privacy guarantees that motivated cache partitioning will decide if the idea moves beyond the draft stage. If it does, future browsers could let you download a 30-plus-gigabyte AI model once and reuse it everywhere—saving time, data, and energy.