Post

Loading React from a public CDN used to mean a visitor probably already had it from another site. Browsers killed that in 2020 to stop cache-timing tracking, so every site now downloads its own copy. The Cross-Origin Storage API keys files by hash to bring sharing back: #webdev #javascript

morello.devCross-Origin Storage API: Stop Downloading Files TwiceThe Cross-Origin Storage API lets sites share one cached copy of a file (a JS library, font, or AI model) across origins by SHA-256 hash. Here's how it works.

17/7/26, 7:35 pm0 reposts3 likes

Dennis Morello

@morello.dev

17 July

The privacy design is the clever part. To stop 'do you have file X?' from becoming a tracking probe, the browser will report a rare file as absent even when it has it, and only confirms files popular enough across enough origins to stay anonymous.

GhostConvert

@ghostconvert.cc

23 July

Cache partitioning hit wasm hardest — every site re-downloads the same multi-MB ffmpeg/vips builds. Worth noting COS doesn't fully dodge the leak though: "is this hash present" is still a history oracle, hence the permission prompt + large-file-only design. Fair trade for codec/model weights.