Firefox Total Cookie Protection: Storage Access API user-gesture requirement during third-party iframe redirect chains

Direct answer

No. Firefox does not reliably treat a top-level page click as transient activation for a third-party iframe that calls document.requestStorageAccess() only after a server-side redirect chain. Expect the promise to reject or storage access to be denied when the call runs in the document loaded by the redirect rather than in the document that received the original input event.

Confirmed behavior versus likely explanation

Confirmed: Total Cookie Protection partitions cookies and site data by top-level site when partitioning is enabled. document.requestStorageAccess() lets an embedded cross-origin iframe request unpartitioned access, and document.hasStorageAccess() reports the current grant. The call requires a secure context and genuine user interaction.

Likely explanation, not a Firefox guarantee: transient activation is scoped to the browsing-context document that handles the input. A server-side redirect loads a new document, so Firefox is not expected to carry the original top-level gesture into the final iframe document. Specification language about user-agent discretion does not require Firefox to preserve activation across redirect chains, and behavior can differ between Release, Beta, and Nightly.

Steps for this case

1. Render a sign-in or continue button inside the identity-provider iframe.
2. On that direct click inside the iframe, call document.requestStorageAccess() synchronously in the same event handler.
3. Await the result. If it resolves, start the OAuth redirect from the iframe. If it rejects, do not retry from a timer or postMessage handler.
4. If the iframe cannot receive a direct click, fall back to top-level navigation or a popup so the identity provider loads as first-party during login.

Verification

Log document.hasStorageAccess() before and after user actions in the iframe context. In Firefox DevTools, compare a top-level click that redirects the iframe through a server-side OAuth URL against a direct click inside the iframe before redirecting. Repeat on Release, Beta, and Nightly, and use channel-specific results rather than assuming redirect-chain activation. After a grant, inspect Storage Inspector for the identity provider's cookie in the iframe context; absence confirms denial.

Missing diagnostic detail

Can the identity-provider iframe display and receive a direct user click? If no, the redirect-chain approach will not satisfy Firefox's gesture requirement, and you should use top-level or popup navigation instead.

Assumptions: this answer treats Firefox channel behavior and Storage Access API heuristics as unverified until tested in your environment. Enterprise policies, container tabs, private browsing, and enhanced tracking protection settings can override partitioning and grant behavior independently of gestures.