The section sold it as a permission prompt on top of the existing flow. A
browser denies requestStorageAccess outright when the embedded origin has no
recent first-party interaction to grant against, and remark42 never gets one:
the reader interacts on the provider's origin, and the callback returns to a
document whose first statement is window.close() under ?selfClose. So the real
cost is changing the first-party experience, either by having the callback
collect a click before closing or by establishing interaction some other way,
which is a different order of cost from the other two routes.
Also states the grant correctly. It lets the frame's requests carry the cookie;
it does not make it script-readable, and the JWT cookie is HttpOnly regardless,
which is what the OAuth paragraph above already says.
Dmitry Verkhoturov
6f7313fcd7